sys/net/if_bridge.c

   1 /*      $NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $       */
   2
   3 /*
   4  * Copyright 2001 Wasabi Systems, Inc.
   5  * All rights reserved.
   6  *
   7  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  * 3. All advertising materials mentioning features or use of this software
  18  *    must display the following acknowledgement:
  19  *      This product includes software developed for the NetBSD Project by
  20  *      Wasabi Systems, Inc.
  21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
  22  *    or promote products derived from this software without specific prior
  23  *    written permission.
  24  *
  25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
  26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
  29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  35  * POSSIBILITY OF SUCH DAMAGE.
  36  */
  37
  38 /*
  39  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
  40  * All rights reserved.
  41  *
  42  * Redistribution and use in source and binary forms, with or without
  43  * modification, are permitted provided that the following conditions
  44  * are met:
  45  * 1. Redistributions of source code must retain the above copyright
  46  *    notice, this list of conditions and the following disclaimer.
  47  * 2. Redistributions in binary form must reproduce the above copyright
  48  *    notice, this list of conditions and the following disclaimer in the
  49  *    documentation and/or other materials provided with the distribution.
  50  * 3. All advertising materials mentioning features or use of this software
  51  *    must display the following acknowledgement:
  52  *      This product includes software developed by Jason L. Wright
  53  * 4. The name of the author may not be used to endorse or promote products
  54  *    derived from this software without specific prior written permission.
  55  *
  56  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  57  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  58  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  59  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  60  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  61  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  62  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  63  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  64  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  65  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  66  * POSSIBILITY OF SUCH DAMAGE.
  67  *
  68  * OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp
  69  */
  70
  71 /*
  72  * Network interface bridge support.
  73  *
  74  * TODO:
  75  *
  76  *      - Currently only supports Ethernet-like interfaces (Ethernet,
  77  *        802.11, VLANs on Ethernet, etc.)  Figure out a nice way
  78  *        to bridge other types of interfaces (FDDI-FDDI, and maybe
  79  *        consider heterogenous bridges).
  80  */
  81
  82 #include <sys/cdefs.h>
  83 __FBSDID("$FreeBSD$");
  84
  85 #include "opt_inet.h"
  86 #include "opt_inet6.h"
  87 #include "opt_carp.h"
  88
  89 #include <sys/param.h>
  90 #include <sys/mbuf.h>
  91 #include <sys/malloc.h>
  92 #include <sys/protosw.h>
  93 #include <sys/systm.h>
  94 #include <sys/time.h>
  95 #include <sys/socket.h> /* for net/if.h */
  96 #include <sys/sockio.h>
  97 #include <sys/ctype.h>  /* string functions */
  98 #include <sys/kernel.h>
  99 #include <sys/random.h>
 100 #include <sys/syslog.h>
 101 #include <sys/sysctl.h>
 102 #include <vm/uma.h>
 103 #include <sys/module.h>
 104 #include <sys/priv.h>
 105 #include <sys/proc.h>
 106 #include <sys/lock.h>
 107 #include <sys/mutex.h>
 108
 109 #include <net/bpf.h>
 110 #include <net/if.h>
 111 #include <net/if_clone.h>
 112 #include <net/if_dl.h>
 113 #include <net/if_types.h>
 114 #include <net/if_var.h>
 115 #include <net/pfil.h>
 116
 117 #include <netinet/in.h> /* for struct arpcom */
 118 #include <netinet/in_systm.h>
 119 #include <netinet/in_var.h>
 120 #include <netinet/ip.h>
 121 #include <netinet/ip_var.h>
 122 #ifdef INET6
 123 #include <netinet/ip6.h>
 124 #include <netinet6/ip6_var.h>
 125 #endif
 126 #ifdef DEV_CARP
 127 #include <netinet/ip_carp.h>
 128 #endif
 129 #include <machine/in_cksum.h>
 130 #include <netinet/if_ether.h> /* for struct arpcom */
 131 #include <net/bridgestp.h>
 132 #include <net/if_bridgevar.h>
 133 #include <net/if_llc.h>
 134
 135 #include <net/route.h>
 136 #include <netinet/ip_fw.h>
 137 #include <netinet/ip_dummynet.h>
 138
 139 /*
 140  * Size of the route hash table.  Must be a power of two.
 141  */
 142 #ifndef BRIDGE_RTHASH_SIZE
 143 #define BRIDGE_RTHASH_SIZE              1024
 144 #endif
 145
 146 #define BRIDGE_RTHASH_MASK              (BRIDGE_RTHASH_SIZE - 1)
 147
 148 /*
 149  * Maximum number of addresses to cache.
 150  */
 151 #ifndef BRIDGE_RTABLE_MAX
 152 #define BRIDGE_RTABLE_MAX               100
 153 #endif
 154
 155 /*
 156  * Timeout (in seconds) for entries learned dynamically.
 157  */
 158 #ifndef BRIDGE_RTABLE_TIMEOUT
 159 #define BRIDGE_RTABLE_TIMEOUT           (20 * 60)       /* same as ARP */
 160 #endif
 161
 162 /*
 163  * Number of seconds between walks of the route list.
 164  */
 165 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
 166 #define BRIDGE_RTABLE_PRUNE_PERIOD      (5 * 60)
 167 #endif
 168
 169 /*
 170  * List of capabilities to mask on the member interface.
 171  */
 172 #define BRIDGE_IFCAPS_MASK              IFCAP_TXCSUM
 173
 174 /*
 175  * Bridge interface list entry.
 176  */
 177 struct bridge_iflist {
 178         LIST_ENTRY(bridge_iflist) bif_next;
 179         struct ifnet            *bif_ifp;       /* member if */
 180         struct bstp_port        bif_stp;        /* STP state */
 181         uint32_t                bif_flags;      /* member if flags */
 182         int                     bif_mutecap;    /* member muted caps */
 183 };
 184
 185 /*
 186  * Bridge route node.
 187  */
 188 struct bridge_rtnode {
 189         LIST_ENTRY(bridge_rtnode) brt_hash;     /* hash table linkage */
 190         LIST_ENTRY(bridge_rtnode) brt_list;     /* list linkage */
 191         struct ifnet            *brt_ifp;       /* destination if */
 192         unsigned long           brt_expire;     /* expiration time */
 193         uint8_t                 brt_flags;      /* address flags */
 194         uint8_t                 brt_addr[ETHER_ADDR_LEN];
 195 };
 196
 197 /*
 198  * Software state for each bridge.
 199  */
 200 struct bridge_softc {
 201         struct ifnet            *sc_ifp;        /* make this an interface */
 202         LIST_ENTRY(bridge_softc) sc_list;
 203         struct mtx              sc_mtx;
 204         struct cv               sc_cv;
 205         uint32_t                sc_brtmax;      /* max # of addresses */
 206         uint32_t                sc_brtcnt;      /* cur. # of addresses */
 207         uint32_t                sc_brttimeout;  /* rt timeout in seconds */
 208         struct callout          sc_brcallout;   /* bridge callout */
 209         uint32_t                sc_iflist_ref;  /* refcount for sc_iflist */
 210         uint32_t                sc_iflist_xcnt; /* refcount for sc_iflist */
 211         LIST_HEAD(, bridge_iflist) sc_iflist;   /* member interface list */
 212         LIST_HEAD(, bridge_rtnode) *sc_rthash;  /* our forwarding table */
 213         LIST_HEAD(, bridge_rtnode) sc_rtlist;   /* list version of above */
 214         uint32_t                sc_rthash_key;  /* key for hash */
 215         LIST_HEAD(, bridge_iflist) sc_spanlist; /* span ports list */
 216         struct bstp_state       sc_stp;         /* STP state */
 217         uint32_t                sc_brtexceeded; /* # of cache drops */
 218 };
 219
 220 static struct mtx       bridge_list_mtx;
 221 eventhandler_tag        bridge_detach_cookie = NULL;
 222
 223 int     bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
 224
 225 uma_zone_t bridge_rtnode_zone;
 226
 227 static int      bridge_clone_create(struct if_clone *, int, caddr_t);
 228 static void     bridge_clone_destroy(struct ifnet *);
 229
 230 static int      bridge_ioctl(struct ifnet *, u_long, caddr_t);
 231 static void     bridge_mutecaps(struct bridge_iflist *, int);
 232 static void     bridge_ifdetach(void *arg __unused, struct ifnet *);
 233 static void     bridge_init(void *);
 234 static void     bridge_dummynet(struct mbuf *, struct ifnet *);
 235 static void     bridge_stop(struct ifnet *, int);
 236 static void     bridge_start(struct ifnet *);
 237 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
 238 static int      bridge_output(struct ifnet *, struct mbuf *, struct sockaddr *,
 239                     struct rtentry *);
 240 static void     bridge_enqueue(struct bridge_softc *, struct ifnet *,
 241                     struct mbuf *);
 242 static void     bridge_rtdelete(struct bridge_softc *, struct ifnet *ifp, int);
 243
 244 static void     bridge_forward(struct bridge_softc *, struct mbuf *m);
 245
 246 static void     bridge_timer(void *);
 247
 248 static void     bridge_broadcast(struct bridge_softc *, struct ifnet *,
 249                     struct mbuf *, int);
 250 static void     bridge_span(struct bridge_softc *, struct mbuf *);
 251
 252 static int      bridge_rtupdate(struct bridge_softc *, const uint8_t *,
 253                     struct bridge_iflist *, int, uint8_t);
 254 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *);
 255 static void     bridge_rttrim(struct bridge_softc *);
 256 static void     bridge_rtage(struct bridge_softc *);
 257 static void     bridge_rtflush(struct bridge_softc *, int);
 258 static int      bridge_rtdaddr(struct bridge_softc *, const uint8_t *);
 259
 260 static int      bridge_rtable_init(struct bridge_softc *);
 261 static void     bridge_rtable_fini(struct bridge_softc *);
 262
 263 static int      bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
 264 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
 265                     const uint8_t *);
 266 static int      bridge_rtnode_insert(struct bridge_softc *,
 267                     struct bridge_rtnode *);
 268 static void     bridge_rtnode_destroy(struct bridge_softc *,
 269                     struct bridge_rtnode *);
 270 static void     bridge_rtable_expire(struct ifnet *, int);
 271 static void     bridge_state_change(struct ifnet *, int);
 272
 273 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
 274                     const char *name);
 275 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
 276                     struct ifnet *ifp);
 277 static void     bridge_delete_member(struct bridge_softc *,
 278                     struct bridge_iflist *, int);
 279 static void     bridge_delete_span(struct bridge_softc *,
 280                     struct bridge_iflist *);
 281
 282 static int      bridge_ioctl_add(struct bridge_softc *, void *);
 283 static int      bridge_ioctl_del(struct bridge_softc *, void *);
 284 static int      bridge_ioctl_gifflags(struct bridge_softc *, void *);
 285 static int      bridge_ioctl_sifflags(struct bridge_softc *, void *);
 286 static int      bridge_ioctl_scache(struct bridge_softc *, void *);
 287 static int      bridge_ioctl_gcache(struct bridge_softc *, void *);
 288 static int      bridge_ioctl_gifs(struct bridge_softc *, void *);
 289 static int      bridge_ioctl_rts(struct bridge_softc *, void *);
 290 static int      bridge_ioctl_saddr(struct bridge_softc *, void *);
 291 static int      bridge_ioctl_sto(struct bridge_softc *, void *);
 292 static int      bridge_ioctl_gto(struct bridge_softc *, void *);
 293 static int      bridge_ioctl_daddr(struct bridge_softc *, void *);
 294 static int      bridge_ioctl_flush(struct bridge_softc *, void *);
 295 static int      bridge_ioctl_gpri(struct bridge_softc *, void *);
 296 static int      bridge_ioctl_spri(struct bridge_softc *, void *);
 297 static int      bridge_ioctl_ght(struct bridge_softc *, void *);
 298 static int      bridge_ioctl_sht(struct bridge_softc *, void *);
 299 static int      bridge_ioctl_gfd(struct bridge_softc *, void *);
 300 static int      bridge_ioctl_sfd(struct bridge_softc *, void *);
 301 static int      bridge_ioctl_gma(struct bridge_softc *, void *);
 302 static int      bridge_ioctl_sma(struct bridge_softc *, void *);
 303 static int      bridge_ioctl_sifprio(struct bridge_softc *, void *);
 304 static int      bridge_ioctl_sifcost(struct bridge_softc *, void *);
 305 static int      bridge_ioctl_addspan(struct bridge_softc *, void *);
 306 static int      bridge_ioctl_delspan(struct bridge_softc *, void *);
 307 static int      bridge_ioctl_gbparam(struct bridge_softc *, void *);
 308 static int      bridge_ioctl_grte(struct bridge_softc *, void *);
 309 static int      bridge_ioctl_gifsstp(struct bridge_softc *, void *);
 310 static int      bridge_ioctl_sproto(struct bridge_softc *, void *);
 311 static int      bridge_ioctl_stxhc(struct bridge_softc *, void *);
 312 static int      bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
 313                     int);
 314 static int      bridge_ip_checkbasic(struct mbuf **mp);
 315 #ifdef INET6
 316 static int      bridge_ip6_checkbasic(struct mbuf **mp);
 317 #endif /* INET6 */
 318 static int      bridge_fragment(struct ifnet *, struct mbuf *,
 319                     struct ether_header *, int, struct llc *);
 320
 321 static struct bstp_cb_ops bridge_ops = {
 322         .bcb_state = bridge_state_change,
 323         .bcb_rtage = bridge_rtable_expire
 324 };
 325
 326 SYSCTL_DECL(_net_link);
 327 SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");
 328
 329 static int pfil_onlyip = 1; /* only pass IP[46] packets when pfil is enabled */
 330 static int pfil_bridge = 1; /* run pfil hooks on the bridge interface */
 331 static int pfil_member = 1; /* run pfil hooks on the member interface */
 332 static int pfil_ipfw = 0;   /* layer2 filter with ipfw */
 333 static int pfil_ipfw_arp = 0;   /* layer2 filter with ipfw */
 334 static int log_stp   = 0;   /* log STP state changes */
 335 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip, CTLFLAG_RW,
 336     &pfil_onlyip, 0, "Only pass IP packets when pfil is enabled");
 337 SYSCTL_INT(_net_link_bridge, OID_AUTO, ipfw_arp, CTLFLAG_RW,
 338     &pfil_ipfw_arp, 0, "Filter ARP packets through IPFW layer2");
 339 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge, CTLFLAG_RW,
 340     &pfil_bridge, 0, "Packet filter on the bridge interface");
 341 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member, CTLFLAG_RW,
 342     &pfil_member, 0, "Packet filter on the member interface");
 343 SYSCTL_INT(_net_link_bridge, OID_AUTO, log_stp, CTLFLAG_RW,
 344     &log_stp, 0, "Log STP state changes");
 345
 346 struct bridge_control {
 347         int     (*bc_func)(struct bridge_softc *, void *);
 348         int     bc_argsize;
 349         int     bc_flags;
 350 };
 351
 352 #define BC_F_COPYIN             0x01    /* copy arguments in */
 353 #define BC_F_COPYOUT            0x02    /* copy arguments out */
 354 #define BC_F_SUSER              0x04    /* do super-user check */
 355
 356 const struct bridge_control bridge_control_table[] = {
 357         { bridge_ioctl_add,             sizeof(struct ifbreq),
 358           BC_F_COPYIN|BC_F_SUSER },
 359         { bridge_ioctl_del,             sizeof(struct ifbreq),
 360           BC_F_COPYIN|BC_F_SUSER },
 361
 362         { bridge_ioctl_gifflags,        sizeof(struct ifbreq),
 363           BC_F_COPYIN|BC_F_COPYOUT },
 364         { bridge_ioctl_sifflags,        sizeof(struct ifbreq),
 365           BC_F_COPYIN|BC_F_SUSER },
 366
 367         { bridge_ioctl_scache,          sizeof(struct ifbrparam),
 368           BC_F_COPYIN|BC_F_SUSER },
 369         { bridge_ioctl_gcache,          sizeof(struct ifbrparam),
 370           BC_F_COPYOUT },
 371
 372         { bridge_ioctl_gifs,            sizeof(struct ifbifconf),
 373           BC_F_COPYIN|BC_F_COPYOUT },
 374         { bridge_ioctl_rts,             sizeof(struct ifbaconf),
 375           BC_F_COPYIN|BC_F_COPYOUT },
 376
 377         { bridge_ioctl_saddr,           sizeof(struct ifbareq),
 378           BC_F_COPYIN|BC_F_SUSER },
 379
 380         { bridge_ioctl_sto,             sizeof(struct ifbrparam),
 381           BC_F_COPYIN|BC_F_SUSER },
 382         { bridge_ioctl_gto,             sizeof(struct ifbrparam),
 383           BC_F_COPYOUT },
 384
 385         { bridge_ioctl_daddr,           sizeof(struct ifbareq),
 386           BC_F_COPYIN|BC_F_SUSER },
 387
 388         { bridge_ioctl_flush,           sizeof(struct ifbreq),
 389           BC_F_COPYIN|BC_F_SUSER },
 390
 391         { bridge_ioctl_gpri,            sizeof(struct ifbrparam),
 392           BC_F_COPYOUT },
 393         { bridge_ioctl_spri,            sizeof(struct ifbrparam),
 394           BC_F_COPYIN|BC_F_SUSER },
 395
 396         { bridge_ioctl_ght,             sizeof(struct ifbrparam),
 397           BC_F_COPYOUT },
 398         { bridge_ioctl_sht,             sizeof(struct ifbrparam),
 399           BC_F_COPYIN|BC_F_SUSER },
 400
 401         { bridge_ioctl_gfd,             sizeof(struct ifbrparam),
 402           BC_F_COPYOUT },
 403         { bridge_ioctl_sfd,             sizeof(struct ifbrparam),
 404           BC_F_COPYIN|BC_F_SUSER },
 405
 406         { bridge_ioctl_gma,             sizeof(struct ifbrparam),
 407           BC_F_COPYOUT },
 408         { bridge_ioctl_sma,             sizeof(struct ifbrparam),
 409           BC_F_COPYIN|BC_F_SUSER },
 410
 411         { bridge_ioctl_sifprio,         sizeof(struct ifbreq),
 412           BC_F_COPYIN|BC_F_SUSER },
 413
 414         { bridge_ioctl_sifcost,         sizeof(struct ifbreq),
 415           BC_F_COPYIN|BC_F_SUSER },
 416
 417         { bridge_ioctl_addspan,         sizeof(struct ifbreq),
 418           BC_F_COPYIN|BC_F_SUSER },
 419         { bridge_ioctl_delspan,         sizeof(struct ifbreq),
 420           BC_F_COPYIN|BC_F_SUSER },
 421
 422         { bridge_ioctl_gbparam,         sizeof(struct ifbropreq),
 423           BC_F_COPYOUT },
 424
 425         { bridge_ioctl_grte,            sizeof(struct ifbrparam),
 426           BC_F_COPYOUT },
 427
 428         { bridge_ioctl_gifsstp,         sizeof(struct ifbpstpconf),
 429           BC_F_COPYIN|BC_F_COPYOUT },
 430
 431         { bridge_ioctl_sproto,          sizeof(struct ifbrparam),
 432           BC_F_COPYIN|BC_F_SUSER },
 433
 434         { bridge_ioctl_stxhc,           sizeof(struct ifbrparam),
 435           BC_F_COPYIN|BC_F_SUSER },
 436 };
 437 const int bridge_control_table_size =
 438     sizeof(bridge_control_table) / sizeof(bridge_control_table[0]);
 439
 440 LIST_HEAD(, bridge_softc) bridge_list;
 441
 442 IFC_SIMPLE_DECLARE(bridge, 0);
 443
 444 static int
 445 bridge_modevent(module_t mod, int type, void *data)
 446 {
 447
 448         switch (type) {
 449         case MOD_LOAD:
 450                 mtx_init(&bridge_list_mtx, "if_bridge list", NULL, MTX_DEF);
 451                 if_clone_attach(&bridge_cloner);
 452                 bridge_rtnode_zone = uma_zcreate("bridge_rtnode",
 453                     sizeof(struct bridge_rtnode), NULL, NULL, NULL, NULL,
 454                     UMA_ALIGN_PTR, 0);
 455                 LIST_INIT(&bridge_list);
 456                 bridge_input_p = bridge_input;
 457                 bridge_output_p = bridge_output;
 458                 bridge_dn_p = bridge_dummynet;
 459                 bridge_detach_cookie = EVENTHANDLER_REGISTER(
 460                     ifnet_departure_event, bridge_ifdetach, NULL,
 461                     EVENTHANDLER_PRI_ANY);
 462                 break;
 463         case MOD_UNLOAD:
 464                 EVENTHANDLER_DEREGISTER(ifnet_departure_event,
 465                     bridge_detach_cookie);
 466                 if_clone_detach(&bridge_cloner);
 467                 uma_zdestroy(bridge_rtnode_zone);
 468                 bridge_input_p = NULL;
 469                 bridge_output_p = NULL;
 470                 bridge_dn_p = NULL;
 471                 mtx_destroy(&bridge_list_mtx);
 472                 break;
 473         default:
 474                 return (EOPNOTSUPP);
 475         }
 476         return (0);
 477 }
 478
 479 static moduledata_t bridge_mod = {
 480         "if_bridge",
 481         bridge_modevent,
 482         0
 483 };
 484
 485 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
 486 MODULE_DEPEND(if_bridge, bridgestp, 1, 1, 1);
 487
 488 /*
 489  * handler for net.link.bridge.pfil_ipfw
 490  */
 491 static int
 492 sysctl_pfil_ipfw(SYSCTL_HANDLER_ARGS)
 493 {
 494         int enable = pfil_ipfw;
 495         int error;
 496
 497         error = sysctl_handle_int(oidp, &enable, 0, req);
 498         enable = (enable) ? 1 : 0;
 499
 500         if (enable != pfil_ipfw) {
 501                 pfil_ipfw = enable;
 502
 503                 /*
 504                  * Disable pfil so that ipfw doesnt run twice, if the user
 505                  * really wants both then they can re-enable pfil_bridge and/or
 506                  * pfil_member. Also allow non-ip packets as ipfw can filter by
 507                  * layer2 type.
 508                  */
 509                 if (pfil_ipfw) {
 510                         pfil_onlyip = 0;
 511                         pfil_bridge = 0;
 512                         pfil_member = 0;
 513                 }
 514         }
 515
 516         return (error);
 517 }
 518 SYSCTL_PROC(_net_link_bridge, OID_AUTO, ipfw, CTLTYPE_INT|CTLFLAG_RW,
 519             &pfil_ipfw, 0, &sysctl_pfil_ipfw, "I", "Layer2 filter with IPFW");
 520
 521 /*
 522  * bridge_clone_create:
 523  *
 524  *      Create a new bridge instance.
 525  */
 526 static int
 527 bridge_clone_create(struct if_clone *ifc, int unit, caddr_t params)
 528 {
 529         struct bridge_softc *sc, *sc2;
 530         struct ifnet *bifp, *ifp;
 531         u_char eaddr[6];
 532         int retry;
 533
 534         sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
 535         ifp = sc->sc_ifp = if_alloc(IFT_ETHER);
 536         if (ifp == NULL) {
 537                 free(sc, M_DEVBUF);
 538                 return (ENOSPC);
 539         }
 540
 541         BRIDGE_LOCK_INIT(sc);
 542         sc->sc_brtmax = BRIDGE_RTABLE_MAX;
 543         sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
 544
 545         /* Initialize our routing table. */
 546         bridge_rtable_init(sc);
 547
 548         callout_init_mtx(&sc->sc_brcallout, &sc->sc_mtx, 0);
 549
 550         LIST_INIT(&sc->sc_iflist);
 551         LIST_INIT(&sc->sc_spanlist);
 552
 553         ifp->if_softc = sc;
 554         if_initname(ifp, ifc->ifc_name, unit);
 555         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 556         ifp->if_ioctl = bridge_ioctl;
 557         ifp->if_start = bridge_start;
 558         ifp->if_init = bridge_init;
 559         ifp->if_type = IFT_BRIDGE;
 560         IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 561         ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 562         IFQ_SET_READY(&ifp->if_snd);
 563
 564         /*
 565          * Generate a random ethernet address with a locally administered
 566          * address.
 567          *
 568          * Since we are using random ethernet addresses for the bridge, it is
 569          * possible that we might have address collisions, so make sure that
 570          * this hardware address isn't already in use on another bridge.
 571          */
 572         for (retry = 1; retry != 0;) {
 573                 arc4rand(eaddr, ETHER_ADDR_LEN, 1);
 574                 eaddr[0] &= ~1;         /* clear multicast bit */
 575                 eaddr[0] |= 2;          /* set the LAA bit */
 576                 retry = 0;
 577                 mtx_lock(&bridge_list_mtx);
 578                 LIST_FOREACH(sc2, &bridge_list, sc_list) {
 579                         bifp = sc2->sc_ifp;
 580                         if (memcmp(eaddr, IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0)
 581                                 retry = 1;
 582                 }
 583                 mtx_unlock(&bridge_list_mtx);
 584         }
 585
 586         bstp_attach(&sc->sc_stp, &bridge_ops);
 587         ether_ifattach(ifp, eaddr);
 588         /* Now undo some of the damage... */
 589         ifp->if_baudrate = 0;
 590         ifp->if_type = IFT_BRIDGE;
 591
 592         mtx_lock(&bridge_list_mtx);
 593         LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
 594         mtx_unlock(&bridge_list_mtx);
 595
 596         return (0);
 597 }
 598
 599 /*
 600  * bridge_clone_destroy:
 601  *
 602  *      Destroy a bridge instance.
 603  */
 604 static void
 605 bridge_clone_destroy(struct ifnet *ifp)
 606 {
 607         struct bridge_softc *sc = ifp->if_softc;
 608         struct bridge_iflist *bif;
 609
 610         BRIDGE_LOCK(sc);
 611
 612         bridge_stop(ifp, 1);
 613         ifp->if_flags &= ~IFF_UP;
 614
 615         while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
 616                 bridge_delete_member(sc, bif, 0);
 617
 618         while ((bif = LIST_FIRST(&sc->sc_spanlist)) != NULL) {
 619                 bridge_delete_span(sc, bif);
 620         }
 621
 622         BRIDGE_UNLOCK(sc);
 623
 624         callout_drain(&sc->sc_brcallout);
 625
 626         mtx_lock(&bridge_list_mtx);
 627         LIST_REMOVE(sc, sc_list);
 628         mtx_unlock(&bridge_list_mtx);
 629
 630         bstp_detach(&sc->sc_stp);
 631         ether_ifdetach(ifp);
 632         if_free_type(ifp, IFT_ETHER);
 633
 634         /* Tear down the routing table. */
 635         bridge_rtable_fini(sc);
 636
 637         BRIDGE_LOCK_DESTROY(sc);
 638         free(sc, M_DEVBUF);
 639 }
 640
 641 /*
 642  * bridge_ioctl:
 643  *
 644  *      Handle a control request from the operator.
 645  */
 646 static int
 647 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 648 {
 649         struct bridge_softc *sc = ifp->if_softc;
 650         struct thread *td = curthread;
 651         union {
 652                 struct ifbreq ifbreq;
 653                 struct ifbifconf ifbifconf;
 654                 struct ifbareq ifbareq;
 655                 struct ifbaconf ifbaconf;
 656                 struct ifbrparam ifbrparam;
 657                 struct ifbropreq ifbropreq;
 658         } args;
 659         struct ifdrv *ifd = (struct ifdrv *) data;
 660         const struct bridge_control *bc;
 661         int error = 0;
 662
 663         BRIDGE_LOCK(sc);
 664
 665         switch (cmd) {
 666
 667         case SIOCADDMULTI:
 668         case SIOCDELMULTI:
 669                 break;
 670
 671         case SIOCGDRVSPEC:
 672         case SIOCSDRVSPEC:
 673                 if (ifd->ifd_cmd >= bridge_control_table_size) {
 674                         error = EINVAL;
 675                         break;
 676                 }
 677                 bc = &bridge_control_table[ifd->ifd_cmd];
 678
 679                 if (cmd == SIOCGDRVSPEC &&
 680                     (bc->bc_flags & BC_F_COPYOUT) == 0) {
 681                         error = EINVAL;
 682                         break;
 683                 }
 684                 else if (cmd == SIOCSDRVSPEC &&
 685                     (bc->bc_flags & BC_F_COPYOUT) != 0) {
 686                         error = EINVAL;
 687                         break;
 688                 }
 689
 690                 if (bc->bc_flags & BC_F_SUSER) {
 691                         error = priv_check(td, PRIV_NET_BRIDGE);
 692                         if (error)
 693                                 break;
 694                 }
 695
 696                 if (ifd->ifd_len != bc->bc_argsize ||
 697                     ifd->ifd_len > sizeof(args)) {
 698                         error = EINVAL;
 699                         break;
 700                 }
 701
 702                 bzero(&args, sizeof(args));
 703                 if (bc->bc_flags & BC_F_COPYIN) {
 704                         error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
 705                         if (error)
 706                                 break;
 707                 }
 708
 709                 error = (*bc->bc_func)(sc, &args);
 710                 if (error)
 711                         break;
 712
 713                 if (bc->bc_flags & BC_F_COPYOUT)
 714                         error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
 715
 716                 break;
 717
 718         case SIOCSIFFLAGS:
 719                 if (!(ifp->if_flags & IFF_UP) &&
 720                     (ifp->if_drv_flags & IFF_DRV_RUNNING)) {
 721                         /*
 722                          * If interface is marked down and it is running,
 723                          * then stop and disable it.
 724                          */
 725                         bridge_stop(ifp, 1);
 726                 } else if ((ifp->if_flags & IFF_UP) &&
 727                     !(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
 728                         /*
 729                          * If interface is marked up and it is stopped, then
 730                          * start it.
 731                          */
 732                         BRIDGE_UNLOCK(sc);
 733                         (*ifp->if_init)(sc);
 734                 }
 735                 break;
 736
 737         case SIOCSIFMTU:
 738                 /* Do not allow the MTU to be changed on the bridge */
 739                 error = EINVAL;
 740                 break;
 741
 742         default:
 743                 /*
 744                  * drop the lock as ether_ioctl() will call bridge_start() and
 745                  * cause the lock to be recursed.
 746                  */
 747                 BRIDGE_UNLOCK(sc);
 748                 error = ether_ioctl(ifp, cmd, data);
 749                 break;
 750         }
 751
 752         if (BRIDGE_LOCKED(sc))
 753                 BRIDGE_UNLOCK(sc);
 754
 755         return (error);
 756 }
 757
 758 /*
 759  * bridge_mutecaps:
 760  *
 761  *      Clear or restore unwanted capabilities on the member interface
 762  */
 763 static void
 764 bridge_mutecaps(struct bridge_iflist *bif, int mute)
 765 {
 766         struct ifnet *ifp = bif->bif_ifp;
 767         struct ifreq ifr;
 768         int error;
 769
 770         if (ifp->if_ioctl == NULL)
 771                 return;
 772
 773         bzero(&ifr, sizeof(ifr));
 774         ifr.ifr_reqcap = ifp->if_capenable;
 775
 776         if (mute) {
 777                 /* mask off and save capabilities */
 778                 bif->bif_mutecap = ifr.ifr_reqcap & BRIDGE_IFCAPS_MASK;
 779                 if (bif->bif_mutecap != 0)
 780                         ifr.ifr_reqcap &= ~BRIDGE_IFCAPS_MASK;
 781         } else
 782                 /* restore muted capabilities */
 783                 ifr.ifr_reqcap |= bif->bif_mutecap;
 784
 785
 786         if (bif->bif_mutecap != 0) {
 787                 IFF_LOCKGIANT(ifp);
 788                 error = (*ifp->if_ioctl)(ifp, SIOCSIFCAP, (caddr_t)&ifr);
 789                 IFF_UNLOCKGIANT(ifp);
 790         }
 791 }
 792
 793 /*
 794  * bridge_lookup_member:
 795  *
 796  *      Lookup a bridge member interface.
 797  */
 798 static struct bridge_iflist *
 799 bridge_lookup_member(struct bridge_softc *sc, const char *name)
 800 {
 801         struct bridge_iflist *bif;
 802         struct ifnet *ifp;
 803
 804         BRIDGE_LOCK_ASSERT(sc);
 805
 806         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 807                 ifp = bif->bif_ifp;
 808                 if (strcmp(ifp->if_xname, name) == 0)
 809                         return (bif);
 810         }
 811
 812         return (NULL);
 813 }
 814
 815 /*
 816  * bridge_lookup_member_if:
 817  *
 818  *      Lookup a bridge member interface by ifnet*.
 819  */
 820 static struct bridge_iflist *
 821 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
 822 {
 823         struct bridge_iflist *bif;
 824
 825         BRIDGE_LOCK_ASSERT(sc);
 826
 827         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 828                 if (bif->bif_ifp == member_ifp)
 829                         return (bif);
 830         }
 831
 832         return (NULL);
 833 }
 834
 835 /*
 836  * bridge_delete_member:
 837  *
 838  *      Delete the specified member interface.
 839  */
 840 static void
 841 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
 842     int gone)
 843 {
 844         struct ifnet *ifs = bif->bif_ifp;
 845
 846         BRIDGE_LOCK_ASSERT(sc);
 847
 848         if (!gone) {
 849                 switch (ifs->if_type) {
 850                 case IFT_ETHER:
 851                 case IFT_L2VLAN:
 852                         /*
 853                          * Take the interface out of promiscuous mode.
 854                          */
 855                         (void) ifpromisc(ifs, 0);
 856                         bridge_mutecaps(bif, 0);
 857                         break;
 858
 859                 case IFT_GIF:
 860                         break;
 861
 862                 default:
 863 #ifdef DIAGNOSTIC
 864                         panic("bridge_delete_member: impossible");
 865 #endif
 866                         break;
 867                 }
 868         }
 869
 870         if (bif->bif_flags & IFBIF_STP)
 871                 bstp_disable(&bif->bif_stp);
 872
 873         ifs->if_bridge = NULL;
 874         BRIDGE_XLOCK(sc);
 875         LIST_REMOVE(bif, bif_next);
 876         BRIDGE_XDROP(sc);
 877
 878         bridge_rtdelete(sc, ifs, IFBF_FLUSHALL);
 879
 880         BRIDGE_UNLOCK(sc);
 881         bstp_destroy(&bif->bif_stp);    /* prepare to free */
 882         BRIDGE_LOCK(sc);
 883         free(bif, M_DEVBUF);
 884 }
 885
 886 /*
 887  * bridge_delete_span:
 888  *
 889  *      Delete the specified span interface.
 890  */
 891 static void
 892 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
 893 {
 894         BRIDGE_LOCK_ASSERT(sc);
 895
 896         KASSERT(bif->bif_ifp->if_bridge == NULL,
 897             ("%s: not a span interface", __func__));
 898
 899         LIST_REMOVE(bif, bif_next);
 900         free(bif, M_DEVBUF);
 901 }
 902
 903 static int
 904 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
 905 {
 906         struct ifbreq *req = arg;
 907         struct bridge_iflist *bif = NULL;
 908         struct ifnet *ifs;
 909         int error = 0;
 910
 911         ifs = ifunit(req->ifbr_ifsname);
 912         if (ifs == NULL)
 913                 return (ENOENT);
 914
 915         /* If it's in the span list, it can't be a member. */
 916         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
 917                 if (ifs == bif->bif_ifp)
 918                         return (EBUSY);
 919
 920         /* Allow the first Ethernet member to define the MTU */
 921         if (ifs->if_type != IFT_GIF) {
 922                 if (LIST_EMPTY(&sc->sc_iflist))
 923                         sc->sc_ifp->if_mtu = ifs->if_mtu;
 924                 else if (sc->sc_ifp->if_mtu != ifs->if_mtu) {
 925                         if_printf(sc->sc_ifp, "invalid MTU for %s\n",
 926                             ifs->if_xname);
 927                         return (EINVAL);
 928                 }
 929         }
 930
 931         if (ifs->if_bridge == sc)
 932                 return (EEXIST);
 933
 934         if (ifs->if_bridge != NULL)
 935                 return (EBUSY);
 936
 937         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
 938         if (bif == NULL)
 939                 return (ENOMEM);
 940
 941         bif->bif_ifp = ifs;
 942         bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
 943
 944         switch (ifs->if_type) {
 945         case IFT_ETHER:
 946         case IFT_L2VLAN:
 947                 /*
 948                  * Place the interface into promiscuous mode.
 949                  */
 950                 error = ifpromisc(ifs, 1);
 951                 if (error)
 952                         goto out;
 953
 954                 bridge_mutecaps(bif, 1);
 955                 break;
 956
 957         case IFT_GIF:
 958                 break;
 959
 960         default:
 961                 error = EINVAL;
 962                 goto out;
 963         }
 964
 965         ifs->if_bridge = sc;
 966         bstp_create(&sc->sc_stp, &bif->bif_stp, bif->bif_ifp);
 967         /*
 968          * XXX: XLOCK HERE!?!
 969          *
 970          * NOTE: insert_***HEAD*** should be safe for the traversals.
 971          */
 972         LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
 973
 974 out:
 975         if (error) {
 976                 if (bif != NULL)
 977                         free(bif, M_DEVBUF);
 978         }
 979         return (error);
 980 }
 981
 982 static int
 983 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
 984 {
 985         struct ifbreq *req = arg;
 986         struct bridge_iflist *bif;
 987
 988         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 989         if (bif == NULL)
 990                 return (ENOENT);
 991
 992         bridge_delete_member(sc, bif, 0);
 993
 994         return (0);
 995 }
 996
 997 static int
 998 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
 999 {
1000         struct ifbreq *req = arg;
1001         struct bridge_iflist *bif;
1002         struct bstp_port *bp;
1003
1004         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1005         if (bif == NULL)
1006                 return (ENOENT);
1007
1008         bp = &bif->bif_stp;
1009         req->ifbr_ifsflags = bif->bif_flags;
1010         req->ifbr_state = bp->bp_state;
1011         req->ifbr_priority = bp->bp_priority;
1012         req->ifbr_path_cost = bp->bp_path_cost;
1013         req->ifbr_portno = bif->bif_ifp->if_index & 0xfff;
1014         req->ifbr_proto = bp->bp_protover;
1015         req->ifbr_role = bp->bp_role;
1016         req->ifbr_stpflags = bp->bp_flags;
1017
1018         /* Copy STP state options as flags */
1019         if (bp->bp_operedge)
1020                 req->ifbr_ifsflags |= IFBIF_BSTP_EDGE;
1021         if (bp->bp_flags & BSTP_PORT_AUTOEDGE)
1022                 req->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE;
1023         if (bp->bp_ptp_link)
1024                 req->ifbr_ifsflags |= IFBIF_BSTP_PTP;
1025         if (bp->bp_flags & BSTP_PORT_AUTOPTP)
1026                 req->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP;
1027         if (bp->bp_flags & BSTP_PORT_ADMEDGE)
1028                 req->ifbr_ifsflags |= IFBIF_BSTP_ADMEDGE;
1029         if (bp->bp_flags & BSTP_PORT_ADMCOST)
1030                 req->ifbr_ifsflags |= IFBIF_BSTP_ADMCOST;
1031         return (0);
1032 }
1033
1034 static int
1035 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
1036 {
1037         struct ifbreq *req = arg;
1038         struct bridge_iflist *bif;
1039         struct bstp_port *bp;
1040         int error;
1041
1042         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1043         if (bif == NULL)
1044                 return (ENOENT);
1045         bp = &bif->bif_stp;
1046
1047         if (req->ifbr_ifsflags & IFBIF_SPAN)
1048                 /* SPAN is readonly */
1049                 return (EINVAL);
1050
1051         if (req->ifbr_ifsflags & IFBIF_STP) {
1052                 if ((bif->bif_flags & IFBIF_STP) == 0) {
1053                         error = bstp_enable(&bif->bif_stp);
1054                         if (error)
1055                                 return (error);
1056                 }
1057         } else {
1058                 if ((bif->bif_flags & IFBIF_STP) != 0)
1059                         bstp_disable(&bif->bif_stp);
1060         }
1061
1062         /* Pass on STP flags */
1063         bstp_set_edge(bp, req->ifbr_ifsflags & IFBIF_BSTP_EDGE ? 1 : 0);
1064         bstp_set_autoedge(bp, req->ifbr_ifsflags & IFBIF_BSTP_AUTOEDGE ? 1 : 0);
1065         bstp_set_ptp(bp, req->ifbr_ifsflags & IFBIF_BSTP_PTP ? 1 : 0);
1066         bstp_set_autoptp(bp, req->ifbr_ifsflags & IFBIF_BSTP_AUTOPTP ? 1 : 0);
1067
1068         /* Save the bits relating to the bridge */
1069         bif->bif_flags = req->ifbr_ifsflags & IFBIFMASK;
1070
1071         return (0);
1072 }
1073
1074 static int
1075 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
1076 {
1077         struct ifbrparam *param = arg;
1078
1079         sc->sc_brtmax = param->ifbrp_csize;
1080         bridge_rttrim(sc);
1081
1082         return (0);
1083 }
1084
1085 static int
1086 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
1087 {
1088         struct ifbrparam *param = arg;
1089
1090         param->ifbrp_csize = sc->sc_brtmax;
1091
1092         return (0);
1093 }
1094
1095 static int
1096 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
1097 {
1098         struct ifbifconf *bifc = arg;
1099         struct bridge_iflist *bif;
1100         struct ifbreq breq;
1101         int count, len, error = 0;
1102
1103         count = 0;
1104         LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
1105                 count++;
1106         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1107                 count++;
1108
1109         if (bifc->ifbic_len == 0) {
1110                 bifc->ifbic_len = sizeof(breq) * count;
1111                 return (0);
1112         }
1113
1114         count = 0;
1115         len = bifc->ifbic_len;
1116         bzero(&breq, sizeof(breq));
1117         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1118                 if (len < sizeof(breq))
1119                         break;
1120
1121                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1122                     sizeof(breq.ifbr_ifsname));
1123                 /* Fill in the ifbreq structure */
1124                 error = bridge_ioctl_gifflags(sc, &breq);
1125                 if (error)
1126                         break;
1127                 error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
1128                 if (error)
1129                         break;
1130                 count++;
1131                 len -= sizeof(breq);
1132         }
1133         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1134                 if (len < sizeof(breq))
1135                         break;
1136
1137                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1138                     sizeof(breq.ifbr_ifsname));
1139                 breq.ifbr_ifsflags = bif->bif_flags;
1140                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xfff;
1141                 error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
1142                 if (error)
1143                         break;
1144                 count++;
1145                 len -= sizeof(breq);
1146         }
1147
1148         bifc->ifbic_len = sizeof(breq) * count;
1149         return (error);
1150 }
1151
1152 static int
1153 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
1154 {
1155         struct ifbaconf *bac = arg;
1156         struct bridge_rtnode *brt;
1157         struct ifbareq bareq;
1158         int count = 0, error = 0, len;
1159
1160         if (bac->ifbac_len == 0)
1161                 return (0);
1162
1163         len = bac->ifbac_len;
1164         bzero(&bareq, sizeof(bareq));
1165         LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
1166                 if (len < sizeof(bareq))
1167                         goto out;
1168                 strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
1169                     sizeof(bareq.ifba_ifsname));
1170                 memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1171                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
1172                                 time_uptime < brt->brt_expire)
1173                         bareq.ifba_expire = brt->brt_expire - time_uptime;
1174                 else
1175                         bareq.ifba_expire = 0;
1176                 bareq.ifba_flags = brt->brt_flags;
1177
1178                 error = copyout(&bareq, bac->ifbac_req + count, sizeof(bareq));
1179                 if (error)
1180                         goto out;
1181                 count++;
1182                 len -= sizeof(bareq);
1183         }
1184 out:
1185         bac->ifbac_len = sizeof(bareq) * count;
1186         return (error);
1187 }
1188
1189 static int
1190 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1191 {
1192         struct ifbareq *req = arg;
1193         struct bridge_iflist *bif;
1194         int error;
1195
1196         bif = bridge_lookup_member(sc, req->ifba_ifsname);
1197         if (bif == NULL)
1198                 return (ENOENT);
1199
1200         error = bridge_rtupdate(sc, req->ifba_dst, bif, 1,
1201             req->ifba_flags);
1202
1203         return (error);
1204 }
1205
1206 static int
1207 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1208 {
1209         struct ifbrparam *param = arg;
1210
1211         sc->sc_brttimeout = param->ifbrp_ctime;
1212         return (0);
1213 }
1214
1215 static int
1216 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1217 {
1218         struct ifbrparam *param = arg;
1219
1220         param->ifbrp_ctime = sc->sc_brttimeout;
1221         return (0);
1222 }
1223
1224 static int
1225 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1226 {
1227         struct ifbareq *req = arg;
1228
1229         return (bridge_rtdaddr(sc, req->ifba_dst));
1230 }
1231
1232 static int
1233 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1234 {
1235         struct ifbreq *req = arg;
1236
1237         bridge_rtflush(sc, req->ifbr_ifsflags);
1238         return (0);
1239 }
1240
1241 static int
1242 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1243 {
1244         struct ifbrparam *param = arg;
1245         struct bstp_state *bs = &sc->sc_stp;
1246
1247         param->ifbrp_prio = bs->bs_bridge_priority;
1248         return (0);
1249 }
1250
1251 static int
1252 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1253 {
1254         struct ifbrparam *param = arg;
1255
1256         return (bstp_set_priority(&sc->sc_stp, param->ifbrp_prio));
1257 }
1258
1259 static int
1260 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1261 {
1262         struct ifbrparam *param = arg;
1263         struct bstp_state *bs = &sc->sc_stp;
1264
1265         param->ifbrp_hellotime = bs->bs_bridge_htime >> 8;
1266         return (0);
1267 }
1268
1269 static int
1270 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1271 {
1272         struct ifbrparam *param = arg;
1273
1274         return (bstp_set_htime(&sc->sc_stp, param->ifbrp_hellotime));
1275 }
1276
1277 static int
1278 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1279 {
1280         struct ifbrparam *param = arg;
1281         struct bstp_state *bs = &sc->sc_stp;
1282
1283         param->ifbrp_fwddelay = bs->bs_bridge_fdelay >> 8;
1284         return (0);
1285 }
1286
1287 static int
1288 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1289 {
1290         struct ifbrparam *param = arg;
1291
1292         return (bstp_set_fdelay(&sc->sc_stp, param->ifbrp_fwddelay));
1293 }
1294
1295 static int
1296 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1297 {
1298         struct ifbrparam *param = arg;
1299         struct bstp_state *bs = &sc->sc_stp;
1300
1301         param->ifbrp_maxage = bs->bs_bridge_max_age >> 8;
1302         return (0);
1303 }
1304
1305 static int
1306 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1307 {
1308         struct ifbrparam *param = arg;
1309
1310         return (bstp_set_maxage(&sc->sc_stp, param->ifbrp_maxage));
1311 }
1312
1313 static int
1314 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1315 {
1316         struct ifbreq *req = arg;
1317         struct bridge_iflist *bif;
1318
1319         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1320         if (bif == NULL)
1321                 return (ENOENT);
1322
1323         return (bstp_set_port_priority(&bif->bif_stp, req->ifbr_priority));
1324 }
1325
1326 static int
1327 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1328 {
1329         struct ifbreq *req = arg;
1330         struct bridge_iflist *bif;
1331
1332         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1333         if (bif == NULL)
1334                 return (ENOENT);
1335
1336         return (bstp_set_path_cost(&bif->bif_stp, req->ifbr_path_cost));
1337 }
1338
1339 static int
1340 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
1341 {
1342         struct ifbreq *req = arg;
1343         struct bridge_iflist *bif = NULL;
1344         struct ifnet *ifs;
1345
1346         ifs = ifunit(req->ifbr_ifsname);
1347         if (ifs == NULL)
1348                 return (ENOENT);
1349
1350         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1351                 if (ifs == bif->bif_ifp)
1352                         return (EBUSY);
1353
1354         if (ifs->if_bridge != NULL)
1355                 return (EBUSY);
1356
1357         switch (ifs->if_type) {
1358                 case IFT_ETHER:
1359                 case IFT_GIF:
1360                 case IFT_L2VLAN:
1361                         break;
1362                 default:
1363                         return (EINVAL);
1364         }
1365
1366         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
1367         if (bif == NULL)
1368                 return (ENOMEM);
1369
1370         bif->bif_ifp = ifs;
1371         bif->bif_flags = IFBIF_SPAN;
1372
1373         LIST_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
1374
1375         return (0);
1376 }
1377
1378 static int
1379 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
1380 {
1381         struct ifbreq *req = arg;
1382         struct bridge_iflist *bif;
1383         struct ifnet *ifs;
1384
1385         ifs = ifunit(req->ifbr_ifsname);
1386         if (ifs == NULL)
1387                 return (ENOENT);
1388
1389         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1390                 if (ifs == bif->bif_ifp)
1391                         break;
1392
1393         if (bif == NULL)
1394                 return (ENOENT);
1395
1396         bridge_delete_span(sc, bif);
1397
1398         return (0);
1399 }
1400
1401 static int
1402 bridge_ioctl_gbparam(struct bridge_softc *sc, void *arg)
1403 {
1404         struct ifbropreq *req = arg;
1405         struct bstp_state *bs = &sc->sc_stp;
1406         struct bstp_port *root_port;
1407
1408         req->ifbop_maxage = bs->bs_bridge_max_age >> 8;
1409         req->ifbop_hellotime = bs->bs_bridge_htime >> 8;
1410         req->ifbop_fwddelay = bs->bs_bridge_fdelay >> 8;
1411
1412         root_port = bs->bs_root_port;
1413         if (root_port == NULL)
1414                 req->ifbop_root_port = 0;
1415         else
1416                 req->ifbop_root_port = root_port->bp_ifp->if_index;
1417
1418         req->ifbop_holdcount = bs->bs_txholdcount;
1419         req->ifbop_priority = bs->bs_bridge_priority;
1420         req->ifbop_protocol = bs->bs_protover;
1421         req->ifbop_root_path_cost = bs->bs_root_pv.pv_cost;
1422         req->ifbop_bridgeid = bs->bs_bridge_pv.pv_dbridge_id;
1423         req->ifbop_designated_root = bs->bs_root_pv.pv_root_id;
1424         req->ifbop_designated_bridge = bs->bs_root_pv.pv_dbridge_id;
1425         req->ifbop_last_tc_time.tv_sec = bs->bs_last_tc_time.tv_sec;
1426         req->ifbop_last_tc_time.tv_usec = bs->bs_last_tc_time.tv_usec;
1427
1428         return (0);
1429 }
1430
1431 static int
1432 bridge_ioctl_grte(struct bridge_softc *sc, void *arg)
1433 {
1434         struct ifbrparam *param = arg;
1435
1436         param->ifbrp_cexceeded = sc->sc_brtexceeded;
1437         return (0);
1438 }
1439
1440 static int
1441 bridge_ioctl_gifsstp(struct bridge_softc *sc, void *arg)
1442 {
1443         struct ifbpstpconf *bifstp = arg;
1444         struct bridge_iflist *bif;
1445         struct bstp_port *bp;
1446         struct ifbpstpreq bpreq;
1447         int count, len, error = 0;
1448
1449         count = 0;
1450         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1451                 if ((bif->bif_flags & IFBIF_STP) != 0)
1452                         count++;
1453         }
1454
1455         if (bifstp->ifbpstp_len == 0) {
1456                 bifstp->ifbpstp_len = sizeof(bpreq) * count;
1457                 return (0);
1458         }
1459
1460         count = 0;
1461         len = bifstp->ifbpstp_len;
1462         bzero(&bpreq, sizeof(bpreq));
1463         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1464                 if (len < sizeof(bpreq))
1465                         break;
1466
1467                 if ((bif->bif_flags & IFBIF_STP) == 0)
1468                         continue;
1469
1470                 bp = &bif->bif_stp;
1471                 bpreq.ifbp_portno = bif->bif_ifp->if_index & 0xfff;
1472                 bpreq.ifbp_fwd_trans = bp->bp_forward_transitions;
1473                 bpreq.ifbp_design_cost = bp->bp_desg_pv.pv_cost;
1474                 bpreq.ifbp_design_port = bp->bp_desg_pv.pv_port_id;
1475                 bpreq.ifbp_design_bridge = bp->bp_desg_pv.pv_dbridge_id;
1476                 bpreq.ifbp_design_root = bp->bp_desg_pv.pv_root_id;
1477
1478                 error = copyout(&bpreq, bifstp->ifbpstp_req + count,
1479                                 sizeof(bpreq));
1480                 if (error != 0)
1481                         break;
1482
1483                 count++;
1484                 len -= sizeof(bpreq);
1485         }
1486
1487         bifstp->ifbpstp_len = sizeof(bpreq) * count;
1488         return (error);
1489 }
1490
1491 static int
1492 bridge_ioctl_sproto(struct bridge_softc *sc, void *arg)
1493 {
1494         struct ifbrparam *param = arg;
1495
1496         return (bstp_set_protocol(&sc->sc_stp, param->ifbrp_proto));
1497 }
1498
1499 static int
1500 bridge_ioctl_stxhc(struct bridge_softc *sc, void *arg)
1501 {
1502         struct ifbrparam *param = arg;
1503
1504         return (bstp_set_holdcount(&sc->sc_stp, param->ifbrp_txhc));
1505 }
1506
1507 /*
1508  * bridge_ifdetach:
1509  *
1510  *      Detach an interface from a bridge.  Called when a member
1511  *      interface is detaching.
1512  */
1513 static void
1514 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
1515 {
1516         struct bridge_softc *sc = ifp->if_bridge;
1517         struct bridge_iflist *bif;
1518
1519         /* Check if the interface is a bridge member */
1520         if (sc != NULL) {
1521                 BRIDGE_LOCK(sc);
1522
1523                 bif = bridge_lookup_member_if(sc, ifp);
1524                 if (bif != NULL)
1525                         bridge_delete_member(sc, bif, 1);
1526
1527                 BRIDGE_UNLOCK(sc);
1528                 return;
1529         }
1530
1531         /* Check if the interface is a span port */
1532         mtx_lock(&bridge_list_mtx);
1533         LIST_FOREACH(sc, &bridge_list, sc_list) {
1534                 BRIDGE_LOCK(sc);
1535                 LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1536                         if (ifp == bif->bif_ifp) {
1537                                 bridge_delete_span(sc, bif);
1538                                 break;
1539                         }
1540
1541                 BRIDGE_UNLOCK(sc);
1542         }
1543         mtx_unlock(&bridge_list_mtx);
1544 }
1545
1546 /*
1547  * bridge_init:
1548  *
1549  *      Initialize a bridge interface.
1550  */
1551 static void
1552 bridge_init(void *xsc)
1553 {
1554         struct bridge_softc *sc = (struct bridge_softc *)xsc;
1555         struct ifnet *ifp = sc->sc_ifp;
1556
1557         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1558                 return;
1559
1560         BRIDGE_LOCK(sc);
1561         callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1562             bridge_timer, sc);
1563
1564         ifp->if_drv_flags |= IFF_DRV_RUNNING;
1565         bstp_init(&sc->sc_stp);         /* Initialize Spanning Tree */
1566
1567         BRIDGE_UNLOCK(sc);
1568 }
1569
1570 /*
1571  * bridge_stop:
1572  *
1573  *      Stop the bridge interface.
1574  */
1575 static void
1576 bridge_stop(struct ifnet *ifp, int disable)
1577 {
1578         struct bridge_softc *sc = ifp->if_softc;
1579
1580         BRIDGE_LOCK_ASSERT(sc);
1581
1582         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1583                 return;
1584
1585         callout_stop(&sc->sc_brcallout);
1586         bstp_stop(&sc->sc_stp);
1587
1588         bridge_rtflush(sc, IFBF_FLUSHDYN);
1589
1590         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1591 }
1592
1593 /*
1594  * bridge_enqueue:
1595  *
1596  *      Enqueue a packet on a bridge member interface.
1597  *
1598  */
1599 static void
1600 bridge_enqueue(struct bridge_softc *sc, struct ifnet *dst_ifp, struct mbuf *m)
1601 {
1602         int len, err = 0;
1603         short mflags;
1604         struct mbuf *m0;
1605
1606         len = m->m_pkthdr.len;
1607         mflags = m->m_flags;
1608
1609         /* We may be sending a fragment so traverse the mbuf */
1610         for (; m; m = m0) {
1611                 m0 = m->m_nextpkt;
1612                 m->m_nextpkt = NULL;
1613
1614                 if (err == 0)
1615                         IFQ_ENQUEUE(&dst_ifp->if_snd, m, err);
1616         }
1617
1618         if (err == 0) {
1619
1620                 sc->sc_ifp->if_opackets++;
1621                 sc->sc_ifp->if_obytes += len;
1622
1623                 dst_ifp->if_obytes += len;
1624
1625                 if (mflags & M_MCAST) {
1626                         sc->sc_ifp->if_omcasts++;
1627                         dst_ifp->if_omcasts++;
1628                 }
1629         }
1630
1631         if ((dst_ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0)
1632                 (*dst_ifp->if_start)(dst_ifp);
1633 }
1634
1635 /*
1636  * bridge_dummynet:
1637  *
1638  *      Receive a queued packet from dummynet and pass it on to the output
1639  *      interface.
1640  *
1641  *      The mbuf has the Ethernet header already attached.
1642  */
1643 static void
1644 bridge_dummynet(struct mbuf *m, struct ifnet *ifp)
1645 {
1646         struct bridge_softc *sc;
1647
1648         sc = ifp->if_bridge;
1649
1650         /*
1651          * The packet didnt originate from a member interface. This should only
1652          * ever happen if a member interface is removed while packets are
1653          * queued for it.
1654          */
1655         if (sc == NULL) {
1656                 m_freem(m);
1657                 return;
1658         }
1659
1660         if (PFIL_HOOKED(&inet_pfil_hook)
1661 #ifdef INET6
1662             || PFIL_HOOKED(&inet6_pfil_hook)
1663 #endif
1664             ) {
1665                 if (bridge_pfil(&m, sc->sc_ifp, ifp, PFIL_OUT) != 0)
1666                         return;
1667                 if (m == NULL)
1668                         return;
1669         }
1670
1671         bridge_enqueue(sc, ifp, m);
1672 }
1673
1674 /*
1675  * bridge_output:
1676  *
1677  *      Send output from a bridge member interface.  This
1678  *      performs the bridging function for locally originated
1679  *      packets.
1680  *
1681  *      The mbuf has the Ethernet header already attached.  We must
1682  *      enqueue or free the mbuf before returning.
1683  */
1684 static int
1685 bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
1686     struct rtentry *rt)
1687 {
1688         struct ether_header *eh;
1689         struct ifnet *dst_if;
1690         struct bridge_softc *sc;
1691
1692         if (m->m_len < ETHER_HDR_LEN) {
1693                 m = m_pullup(m, ETHER_HDR_LEN);
1694                 if (m == NULL)
1695                         return (0);
1696         }
1697
1698         eh = mtod(m, struct ether_header *);
1699         sc = ifp->if_bridge;
1700
1701         BRIDGE_LOCK(sc);
1702
1703         /*
1704          * If bridge is down, but the original output interface is up,
1705          * go ahead and send out that interface.  Otherwise, the packet
1706          * is dropped below.
1707          */
1708         if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1709                 dst_if = ifp;
1710                 goto sendunicast;
1711         }
1712
1713         /*
1714          * If the packet is a multicast, or we don't know a better way to
1715          * get there, send to all interfaces.
1716          */
1717         if (ETHER_IS_MULTICAST(eh->ether_dhost))
1718                 dst_if = NULL;
1719         else
1720                 dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1721         if (dst_if == NULL) {
1722                 struct bridge_iflist *bif;
1723                 struct mbuf *mc;
1724                 int error = 0, used = 0;
1725
1726                 bridge_span(sc, m);
1727
1728                 BRIDGE_LOCK2REF(sc, error);
1729                 if (error) {
1730                         m_freem(m);
1731                         return (0);
1732                 }
1733
1734                 LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1735                         dst_if = bif->bif_ifp;
1736
1737                         if (dst_if->if_type == IFT_GIF)
1738                                 continue;
1739                         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
1740                                 continue;
1741
1742                         /*
1743                          * If this is not the original output interface,
1744                          * and the interface is participating in spanning
1745                          * tree, make sure the port is in a state that
1746                          * allows forwarding.
1747                          */
1748                         if (dst_if != ifp && (bif->bif_flags & IFBIF_STP) &&
1749                             bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
1750                                 continue;
1751
1752                         if (LIST_NEXT(bif, bif_next) == NULL) {
1753                                 used = 1;
1754                                 mc = m;
1755                         } else {
1756                                 mc = m_copypacket(m, M_DONTWAIT);
1757                                 if (mc == NULL) {
1758                                         sc->sc_ifp->if_oerrors++;
1759                                         continue;
1760                                 }
1761                         }
1762
1763                         bridge_enqueue(sc, dst_if, mc);
1764                 }
1765                 if (used == 0)
1766                         m_freem(m);
1767                 BRIDGE_UNREF(sc);
1768                 return (0);
1769         }
1770
1771 sendunicast:
1772         /*
1773          * XXX Spanning tree consideration here?
1774          */
1775
1776         bridge_span(sc, m);
1777         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1778                 m_freem(m);
1779                 BRIDGE_UNLOCK(sc);
1780                 return (0);
1781         }
1782
1783         BRIDGE_UNLOCK(sc);
1784         bridge_enqueue(sc, dst_if, m);
1785         return (0);
1786 }
1787
1788 /*
1789  * bridge_start:
1790  *
1791  *      Start output on a bridge.
1792  *
1793  */
1794 static void
1795 bridge_start(struct ifnet *ifp)
1796 {
1797         struct bridge_softc *sc;
1798         struct mbuf *m;
1799         struct ether_header *eh;
1800         struct ifnet *dst_if;
1801
1802         sc = ifp->if_softc;
1803
1804         ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1805         for (;;) {
1806                 IFQ_DEQUEUE(&ifp->if_snd, m);
1807                 if (m == 0)
1808                         break;
1809                 BPF_MTAP(ifp, m);
1810
1811                 eh = mtod(m, struct ether_header *);
1812                 dst_if = NULL;
1813
1814                 BRIDGE_LOCK(sc);
1815                 if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1816                         dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1817                 }
1818
1819                 if (dst_if == NULL)
1820                         bridge_broadcast(sc, ifp, m, 0);
1821                 else {
1822                         BRIDGE_UNLOCK(sc);
1823                         bridge_enqueue(sc, dst_if, m);
1824                 }
1825         }
1826         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1827 }
1828
1829 /*
1830  * bridge_forward:
1831  *
1832  *      The forwarding function of the bridge.
1833  *
1834  *      NOTE: Releases the lock on return.
1835  */
1836 static void
1837 bridge_forward(struct bridge_softc *sc, struct mbuf *m)
1838 {
1839         struct bridge_iflist *bif;
1840         struct ifnet *src_if, *dst_if, *ifp;
1841         struct ether_header *eh;
1842
1843         src_if = m->m_pkthdr.rcvif;
1844         ifp = sc->sc_ifp;
1845
1846         sc->sc_ifp->if_ipackets++;
1847         sc->sc_ifp->if_ibytes += m->m_pkthdr.len;
1848
1849         /*
1850          * Look up the bridge_iflist.
1851          */
1852         bif = bridge_lookup_member_if(sc, src_if);
1853         if (bif == NULL) {
1854                 /* Interface is not a bridge member (anymore?) */
1855                 BRIDGE_UNLOCK(sc);
1856                 m_freem(m);
1857                 return;
1858         }
1859
1860         if ((bif->bif_flags & IFBIF_STP) &&
1861             bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
1862                 BRIDGE_UNLOCK(sc);
1863                 m_freem(m);
1864                 return;
1865         }
1866
1867         eh = mtod(m, struct ether_header *);
1868
1869         /*
1870          * If the interface is learning, and the source
1871          * address is valid and not multicast, record
1872          * the address.
1873          */
1874         if ((bif->bif_flags & IFBIF_LEARNING) != 0 &&
1875             ETHER_IS_MULTICAST(eh->ether_shost) == 0 &&
1876             (eh->ether_shost[0] == 0 &&
1877              eh->ether_shost[1] == 0 &&
1878              eh->ether_shost[2] == 0 &&
1879              eh->ether_shost[3] == 0 &&
1880              eh->ether_shost[4] == 0 &&
1881              eh->ether_shost[5] == 0) == 0) {
1882                 (void) bridge_rtupdate(sc, eh->ether_shost,
1883                     bif, 0, IFBAF_DYNAMIC);
1884         }
1885
1886         if ((bif->bif_flags & IFBIF_STP) != 0 &&
1887             bif->bif_stp.bp_state == BSTP_IFSTATE_LEARNING) {
1888                 m_freem(m);
1889                 BRIDGE_UNLOCK(sc);
1890                 return;
1891         }
1892
1893         /*
1894          * At this point, the port either doesn't participate
1895          * in spanning tree or it is in the forwarding state.
1896          */
1897
1898         /*
1899          * If the packet is unicast, destined for someone on
1900          * "this" side of the bridge, drop it.
1901          */
1902         if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1903                 dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1904                 if (src_if == dst_if) {
1905                         BRIDGE_UNLOCK(sc);
1906                         m_freem(m);
1907                         return;
1908                 }
1909         } else {
1910                 /* ...forward it to all interfaces. */
1911                 sc->sc_ifp->if_imcasts++;
1912                 dst_if = NULL;
1913         }
1914
1915         /*
1916          * If we have a destination interface which is a member of our bridge,
1917          * OR this is a unicast packet, push it through the bpf(4) machinery.
1918          * For broadcast or multicast packets, don't bother because it will
1919          * be reinjected into ether_input. We do this before we pass the packets
1920          * through the pfil(9) framework, as it is possible that pfil(9) will
1921          * drop the packet, or possibly modify it, making it difficult to debug
1922          * firewall issues on the bridge.
1923          */
1924         if (dst_if != NULL || (m->m_flags & (M_BCAST | M_MCAST)) == 0)
1925                 BPF_MTAP(ifp, m);
1926
1927         /* run the packet filter */
1928         if (PFIL_HOOKED(&inet_pfil_hook)
1929 #ifdef INET6
1930             || PFIL_HOOKED(&inet6_pfil_hook)
1931 #endif
1932             ) {
1933                 BRIDGE_UNLOCK(sc);
1934                 if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
1935                         return;
1936                 if (m == NULL)
1937                         return;
1938                 BRIDGE_LOCK(sc);
1939         }
1940
1941         if (dst_if == NULL) {
1942                 bridge_broadcast(sc, src_if, m, 1);
1943                 return;
1944         }
1945
1946         /*
1947          * At this point, we're dealing with a unicast frame
1948          * going to a different interface.
1949          */
1950         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1951                 BRIDGE_UNLOCK(sc);
1952                 m_freem(m);
1953                 return;
1954         }
1955         bif = bridge_lookup_member_if(sc, dst_if);
1956         if (bif == NULL) {
1957                 /* Not a member of the bridge (anymore?) */
1958                 BRIDGE_UNLOCK(sc);
1959                 m_freem(m);
1960                 return;
1961         }
1962
1963         if ((bif->bif_flags & IFBIF_STP) &&
1964             bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
1965                 BRIDGE_UNLOCK(sc);
1966                 m_freem(m);
1967                 return;
1968         }
1969
1970         BRIDGE_UNLOCK(sc);
1971
1972         if (PFIL_HOOKED(&inet_pfil_hook)
1973 #ifdef INET6
1974             || PFIL_HOOKED(&inet6_pfil_hook)
1975 #endif
1976             ) {
1977                 if (bridge_pfil(&m, sc->sc_ifp, dst_if, PFIL_OUT) != 0)
1978                         return;
1979                 if (m == NULL)
1980                         return;
1981         }
1982
1983         bridge_enqueue(sc, dst_if, m);
1984 }
1985
1986 /*
1987  * bridge_input:
1988  *
1989  *      Receive input from a member interface.  Queue the packet for
1990  *      bridging if it is not for us.
1991  */
1992 static struct mbuf *
1993 bridge_input(struct ifnet *ifp, struct mbuf *m)
1994 {
1995         struct bridge_softc *sc = ifp->if_bridge;
1996         struct bridge_iflist *bif, *bif2;
1997         struct ifnet *bifp;
1998         struct ether_header *eh;
1999         struct mbuf *mc, *mc2;
2000
2001         if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2002                 return (m);
2003
2004         bifp = sc->sc_ifp;
2005
2006         /*
2007          * Implement support for bridge monitoring. If this flag has been
2008          * set on this interface, discard the packet once we push it through
2009          * the bpf(4) machinery, but before we do, increment the byte and
2010          * packet counters associated with this interface.
2011          */
2012         if ((bifp->if_flags & IFF_MONITOR) != 0) {
2013                 m->m_pkthdr.rcvif  = bifp;
2014                 BPF_MTAP(bifp, m);
2015                 bifp->if_ipackets++;
2016                 bifp->if_ibytes += m->m_pkthdr.len;
2017                 m_freem(m);
2018                 return (NULL);
2019         }
2020         BRIDGE_LOCK(sc);
2021         bif = bridge_lookup_member_if(sc, ifp);
2022         if (bif == NULL) {
2023                 BRIDGE_UNLOCK(sc);
2024                 return (m);
2025         }
2026
2027         eh = mtod(m, struct ether_header *);
2028
2029         if (memcmp(eh->ether_dhost, IF_LLADDR(bifp),
2030             ETHER_ADDR_LEN) == 0) {
2031                 /*
2032                  * If the packet is for us, set the packets source as the
2033                  * bridge, and return the packet back to ether_input for
2034                  * local processing.
2035                  */
2036
2037                 /* Note where to send the reply to */
2038                 if (bif->bif_flags & IFBIF_LEARNING)
2039                         (void) bridge_rtupdate(sc,
2040                             eh->ether_shost, bif, 0, IFBAF_DYNAMIC);
2041
2042                 /* Mark the packet as arriving on the bridge interface */
2043                 m->m_pkthdr.rcvif = bifp;
2044                 BPF_MTAP(bifp, m);
2045                 bifp->if_ipackets++;
2046
2047                 BRIDGE_UNLOCK(sc);
2048                 return (m);
2049         }
2050
2051         bridge_span(sc, m);
2052
2053         if (m->m_flags & (M_BCAST|M_MCAST)) {
2054                 /* Tap off 802.1D packets; they do not get forwarded. */
2055                 if (memcmp(eh->ether_dhost, bstp_etheraddr,
2056                     ETHER_ADDR_LEN) == 0) {
2057                         m = bstp_input(&bif->bif_stp, ifp, m);
2058                         if (m == NULL) {
2059                                 BRIDGE_UNLOCK(sc);
2060                                 return (NULL);
2061                         }
2062                 }
2063
2064                 if ((bif->bif_flags & IFBIF_STP) &&
2065                     bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
2066                         BRIDGE_UNLOCK(sc);
2067                         return (m);
2068                 }
2069
2070                 /*
2071                  * Make a deep copy of the packet and enqueue the copy
2072                  * for bridge processing; return the original packet for
2073                  * local processing.
2074                  */
2075                 mc = m_dup(m, M_DONTWAIT);
2076                 if (mc == NULL) {
2077                         BRIDGE_UNLOCK(sc);
2078                         return (m);
2079                 }
2080
2081                 /* Perform the bridge forwarding function with the copy. */
2082                 bridge_forward(sc, mc);
2083
2084                 /*
2085                  * Reinject the mbuf as arriving on the bridge so we have a
2086                  * chance at claiming multicast packets. We can not loop back
2087                  * here from ether_input as a bridge is never a member of a
2088                  * bridge.
2089                  */
2090                 KASSERT(bifp->if_bridge == NULL,
2091                     ("loop created in bridge_input"));
2092                 mc2 = m_dup(m, M_DONTWAIT);
2093                 if (mc2 != NULL) {
2094                         /* Keep the layer3 header aligned */
2095                         int i = min(mc2->m_pkthdr.len, max_protohdr);
2096                         mc2 = m_copyup(mc2, i, ETHER_ALIGN);
2097                 }
2098                 if (mc2 != NULL) {
2099                         mc2->m_pkthdr.rcvif = bifp;
2100                         (*bifp->if_input)(bifp, mc2);
2101                 }
2102
2103                 /* Return the original packet for local processing. */
2104                 return (m);
2105         }
2106
2107         if ((bif->bif_flags & IFBIF_STP) &&
2108             bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
2109                 BRIDGE_UNLOCK(sc);
2110                 return (m);
2111         }
2112
2113 #ifdef DEV_CARP
2114 #   define OR_CARP_CHECK_WE_ARE_DST(iface) \
2115         || ((iface)->if_carp \
2116             && carp_forus((iface)->if_carp, eh->ether_dhost))
2117 #   define OR_CARP_CHECK_WE_ARE_SRC(iface) \
2118         || ((iface)->if_carp \
2119             && carp_forus((iface)->if_carp, eh->ether_shost))
2120 #else
2121 #   define OR_CARP_CHECK_WE_ARE_DST(iface)
2122 #   define OR_CARP_CHECK_WE_ARE_SRC(iface)
2123 #endif
2124
2125 #define GRAB_OUR_PACKETS(iface) \
2126         if ((iface)->if_type == IFT_GIF) \
2127                 continue; \
2128         /* It is destined for us. */ \
2129         if (memcmp(IF_LLADDR((iface)), eh->ether_dhost,  ETHER_ADDR_LEN) == 0 \
2130             OR_CARP_CHECK_WE_ARE_DST((iface))                           \
2131             ) {                                                         \
2132                 if (bif->bif_flags & IFBIF_LEARNING)                    \
2133                         (void) bridge_rtupdate(sc,                      \
2134                             eh->ether_shost, bif, 0, IFBAF_DYNAMIC);    \
2135                 m->m_pkthdr.rcvif = iface;                              \
2136                 BRIDGE_UNLOCK(sc);                                      \
2137                 return (m);                                             \
2138         }                                                               \
2139                                                                         \
2140         /* We just received a packet that we sent out. */               \
2141         if (memcmp(IF_LLADDR((iface)), eh->ether_shost, ETHER_ADDR_LEN) == 0 \
2142             OR_CARP_CHECK_WE_ARE_SRC((iface))                   \
2143             ) {                                                         \
2144                 BRIDGE_UNLOCK(sc);                                      \
2145                 m_freem(m);                                             \
2146                 return (NULL);                                          \
2147         }
2148
2149         /*
2150          * Unicast.  Make sure it's not for us.
2151          *
2152          * Give a chance for ifp at first priority. This will help when the
2153          * packet comes through the interface like VLAN's with the same MACs
2154          * on several interfaces from the same bridge. This also will save
2155          * some CPU cycles in case the destination interface and the input
2156          * interface (eq ifp) are the same.
2157          */
2158         do { GRAB_OUR_PACKETS(ifp) } while (0);
2159
2160         /* Now check the all bridge members. */
2161         LIST_FOREACH(bif2, &sc->sc_iflist, bif_next) {
2162                 GRAB_OUR_PACKETS(bif2->bif_ifp)
2163         }
2164
2165 #undef OR_CARP_CHECK_WE_ARE_DST
2166 #undef OR_CARP_CHECK_WE_ARE_SRC
2167 #undef GRAB_OUR_PACKETS
2168
2169         /* Perform the bridge forwarding function. */
2170         bridge_forward(sc, m);
2171
2172         return (NULL);
2173 }
2174
2175 /*
2176  * bridge_broadcast:
2177  *
2178  *      Send a frame to all interfaces that are members of
2179  *      the bridge, except for the one on which the packet
2180  *      arrived.
2181  *
2182  *      NOTE: Releases the lock on return.
2183  */
2184 static void
2185 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
2186     struct mbuf *m, int runfilt)
2187 {
2188         struct bridge_iflist *bif;
2189         struct mbuf *mc;
2190         struct ifnet *dst_if;
2191         int error = 0, used = 0, i;
2192
2193         BRIDGE_LOCK2REF(sc, error);
2194         if (error) {
2195                 m_freem(m);
2196                 return;
2197         }
2198
2199         /* Filter on the bridge interface before broadcasting */
2200         if (runfilt && (PFIL_HOOKED(&inet_pfil_hook)
2201 #ifdef INET6
2202             || PFIL_HOOKED(&inet6_pfil_hook)
2203 #endif
2204             )) {
2205                 if (bridge_pfil(&m, sc->sc_ifp, NULL, PFIL_OUT) != 0)
2206                         goto out;
2207                 if (m == NULL)
2208                         goto out;
2209         }
2210
2211         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
2212                 dst_if = bif->bif_ifp;
2213                 if (dst_if == src_if)
2214                         continue;
2215
2216                 if ((bif->bif_flags & IFBIF_STP) &&
2217                     bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2218                         continue;
2219
2220                 if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
2221                     (m->m_flags & (M_BCAST|M_MCAST)) == 0)
2222                         continue;
2223
2224                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2225                         continue;
2226
2227                 if (LIST_NEXT(bif, bif_next) == NULL) {
2228                         mc = m;
2229                         used = 1;
2230                 } else {
2231                         mc = m_dup(m, M_DONTWAIT);
2232                         if (mc == NULL) {
2233                                 sc->sc_ifp->if_oerrors++;
2234                                 continue;
2235                         }
2236                 }
2237
2238                 /*
2239                  * Filter on the output interface. Pass a NULL bridge interface
2240                  * pointer so we do not redundantly filter on the bridge for
2241                  * each interface we broadcast on.
2242                  */
2243                 if (runfilt && (PFIL_HOOKED(&inet_pfil_hook)
2244 #ifdef INET6
2245                     || PFIL_HOOKED(&inet6_pfil_hook)
2246 #endif
2247                     )) {
2248                         if (used == 0) {
2249                                 /* Keep the layer3 header aligned */
2250                                 i = min(mc->m_pkthdr.len, max_protohdr);
2251                                 mc = m_copyup(mc, i, ETHER_ALIGN);
2252                                 if (mc == NULL) {
2253                                         sc->sc_ifp->if_oerrors++;
2254                                         continue;
2255                                 }
2256                         }
2257                         if (bridge_pfil(&mc, NULL, dst_if, PFIL_OUT) != 0)
2258                                 continue;
2259                         if (mc == NULL)
2260                                 continue;
2261                 }
2262
2263                 bridge_enqueue(sc, dst_if, mc);
2264         }
2265         if (used == 0)
2266                 m_freem(m);
2267
2268 out:
2269         BRIDGE_UNREF(sc);
2270 }
2271
2272 /*
2273  * bridge_span:
2274  *
2275  *      Duplicate a packet out one or more interfaces that are in span mode,
2276  *      the original mbuf is unmodified.
2277  */
2278 static void
2279 bridge_span(struct bridge_softc *sc, struct mbuf *m)
2280 {
2281         struct bridge_iflist *bif;
2282         struct ifnet *dst_if;
2283         struct mbuf *mc;
2284
2285         if (LIST_EMPTY(&sc->sc_spanlist))
2286                 return;
2287
2288         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
2289                 dst_if = bif->bif_ifp;
2290
2291                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2292                         continue;
2293
2294                 mc = m_copypacket(m, M_DONTWAIT);
2295                 if (mc == NULL) {
2296                         sc->sc_ifp->if_oerrors++;
2297                         continue;
2298                 }
2299
2300                 bridge_enqueue(sc, dst_if, mc);
2301         }
2302 }
2303
2304 /*
2305  * bridge_rtupdate:
2306  *
2307  *      Add a bridge routing entry.
2308  */
2309 static int
2310 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst,
2311     struct bridge_iflist *bif, int setflags, uint8_t flags)
2312 {
2313         struct bridge_rtnode *brt;
2314         struct ifnet *dst_if = bif->bif_ifp;
2315         int error;
2316
2317         BRIDGE_LOCK_ASSERT(sc);
2318
2319         /*
2320          * A route for this destination might already exist.  If so,
2321          * update it, otherwise create a new one.
2322          */
2323         if ((brt = bridge_rtnode_lookup(sc, dst)) == NULL) {
2324                 if (sc->sc_brtcnt >= sc->sc_brtmax) {
2325                         sc->sc_brtexceeded++;
2326                         return (ENOSPC);
2327                 }
2328
2329                 /*
2330                  * Allocate a new bridge forwarding node, and
2331                  * initialize the expiration time and Ethernet
2332                  * address.
2333                  */
2334                 brt = uma_zalloc(bridge_rtnode_zone, M_NOWAIT | M_ZERO);
2335                 if (brt == NULL)
2336                         return (ENOMEM);
2337
2338                 if (bif->bif_flags & IFBIF_STICKY)
2339                         brt->brt_flags = IFBAF_STICKY;
2340                 else
2341                         brt->brt_flags = IFBAF_DYNAMIC;
2342
2343                 brt->brt_ifp = dst_if;
2344                 memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
2345
2346                 if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
2347                         uma_zfree(bridge_rtnode_zone, brt);
2348                         return (error);
2349                 }
2350         }
2351
2352         if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2353                 brt->brt_ifp = dst_if;
2354         if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2355                 brt->brt_expire = time_uptime + sc->sc_brttimeout;
2356         if (setflags)
2357                 brt->brt_flags = flags;
2358
2359         return (0);
2360 }
2361
2362 /*
2363  * bridge_rtlookup:
2364  *
2365  *      Lookup the destination interface for an address.
2366  */
2367 static struct ifnet *
2368 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr)
2369 {
2370         struct bridge_rtnode *brt;
2371
2372         BRIDGE_LOCK_ASSERT(sc);
2373
2374         if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2375                 return (NULL);
2376
2377         return (brt->brt_ifp);
2378 }
2379
2380 /*
2381  * bridge_rttrim:
2382  *
2383  *      Trim the routine table so that we have a number
2384  *      of routing entries less than or equal to the
2385  *      maximum number.
2386  */
2387 static void
2388 bridge_rttrim(struct bridge_softc *sc)
2389 {
2390         struct bridge_rtnode *brt, *nbrt;
2391
2392         BRIDGE_LOCK_ASSERT(sc);
2393
2394         /* Make sure we actually need to do this. */
2395         if (sc->sc_brtcnt <= sc->sc_brtmax)
2396                 return;
2397
2398         /* Force an aging cycle; this might trim enough addresses. */
2399         bridge_rtage(sc);
2400         if (sc->sc_brtcnt <= sc->sc_brtmax)
2401                 return;
2402
2403         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2404                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2405                         bridge_rtnode_destroy(sc, brt);
2406                         if (sc->sc_brtcnt <= sc->sc_brtmax)
2407                                 return;
2408                 }
2409         }
2410 }
2411
2412 /*
2413  * bridge_timer:
2414  *
2415  *      Aging timer for the bridge.
2416  */
2417 static void
2418 bridge_timer(void *arg)
2419 {
2420         struct bridge_softc *sc = arg;
2421
2422         BRIDGE_LOCK_ASSERT(sc);
2423
2424         bridge_rtage(sc);
2425
2426         if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
2427                 callout_reset(&sc->sc_brcallout,
2428                     bridge_rtable_prune_period * hz, bridge_timer, sc);
2429 }
2430
2431 /*
2432  * bridge_rtage:
2433  *
2434  *      Perform an aging cycle.
2435  */
2436 static void
2437 bridge_rtage(struct bridge_softc *sc)
2438 {
2439         struct bridge_rtnode *brt, *nbrt;
2440
2441         BRIDGE_LOCK_ASSERT(sc);
2442
2443         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2444                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2445                         if (time_uptime >= brt->brt_expire)
2446                                 bridge_rtnode_destroy(sc, brt);
2447                 }
2448         }
2449 }
2450
2451 /*
2452  * bridge_rtflush:
2453  *
2454  *      Remove all dynamic addresses from the bridge.
2455  */
2456 static void
2457 bridge_rtflush(struct bridge_softc *sc, int full)
2458 {
2459         struct bridge_rtnode *brt, *nbrt;
2460
2461         BRIDGE_LOCK_ASSERT(sc);
2462
2463         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2464                 if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2465                         bridge_rtnode_destroy(sc, brt);
2466         }
2467 }
2468
2469 /*
2470  * bridge_rtdaddr:
2471  *
2472  *      Remove an address from the table.
2473  */
2474 static int
2475 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr)
2476 {
2477         struct bridge_rtnode *brt;
2478
2479         BRIDGE_LOCK_ASSERT(sc);
2480
2481         if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2482                 return (ENOENT);
2483
2484         bridge_rtnode_destroy(sc, brt);
2485         return (0);
2486 }
2487
2488 /*
2489  * bridge_rtdelete:
2490  *
2491  *      Delete routes to a speicifc member interface.
2492  */
2493 static void
2494 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int full)
2495 {
2496         struct bridge_rtnode *brt, *nbrt;
2497
2498         BRIDGE_LOCK_ASSERT(sc);
2499
2500         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2501                 if (brt->brt_ifp == ifp && (full ||
2502                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC))
2503                         bridge_rtnode_destroy(sc, brt);
2504         }
2505 }
2506
2507 /*
2508  * bridge_rtable_init:
2509  *
2510  *      Initialize the route table for this bridge.
2511  */
2512 static int
2513 bridge_rtable_init(struct bridge_softc *sc)
2514 {
2515         int i;
2516
2517         sc->sc_rthash = malloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
2518             M_DEVBUF, M_NOWAIT);
2519         if (sc->sc_rthash == NULL)
2520                 return (ENOMEM);
2521
2522         for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
2523                 LIST_INIT(&sc->sc_rthash[i]);
2524
2525         sc->sc_rthash_key = arc4random();
2526
2527         LIST_INIT(&sc->sc_rtlist);
2528
2529         return (0);
2530 }
2531
2532 /*
2533  * bridge_rtable_fini:
2534  *
2535  *      Deconstruct the route table for this bridge.
2536  */
2537 static void
2538 bridge_rtable_fini(struct bridge_softc *sc)
2539 {
2540
2541         free(sc->sc_rthash, M_DEVBUF);
2542 }
2543
2544 /*
2545  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
2546  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
2547  */
2548 #define mix(a, b, c)                                                    \
2549 do {                                                                    \
2550         a -= b; a -= c; a ^= (c >> 13);                                 \
2551         b -= c; b -= a; b ^= (a << 8);                                  \
2552         c -= a; c -= b; c ^= (b >> 13);                                 \
2553         a -= b; a -= c; a ^= (c >> 12);                                 \
2554         b -= c; b -= a; b ^= (a << 16);                                 \
2555         c -= a; c -= b; c ^= (b >> 5);                                  \
2556         a -= b; a -= c; a ^= (c >> 3);                                  \
2557         b -= c; b -= a; b ^= (a << 10);                                 \
2558         c -= a; c -= b; c ^= (b >> 15);                                 \
2559 } while (/*CONSTCOND*/0)
2560
2561 static __inline uint32_t
2562 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
2563 {
2564         uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
2565
2566         b += addr[5] << 8;
2567         b += addr[4];
2568         a += addr[3] << 24;
2569         a += addr[2] << 16;
2570         a += addr[1] << 8;
2571         a += addr[0];
2572
2573         mix(a, b, c);
2574
2575         return (c & BRIDGE_RTHASH_MASK);
2576 }
2577
2578 #undef mix
2579
2580 static int
2581 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
2582 {
2583         int i, d;
2584
2585         for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
2586                 d = ((int)a[i]) - ((int)b[i]);
2587         }
2588
2589         return (d);
2590 }
2591
2592 /*
2593  * bridge_rtnode_lookup:
2594  *
2595  *      Look up a bridge route node for the specified destination.
2596  */
2597 static struct bridge_rtnode *
2598 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr)
2599 {
2600         struct bridge_rtnode *brt;
2601         uint32_t hash;
2602         int dir;
2603
2604         BRIDGE_LOCK_ASSERT(sc);
2605
2606         hash = bridge_rthash(sc, addr);
2607         LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
2608                 dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
2609                 if (dir == 0)
2610                         return (brt);
2611                 if (dir > 0)
2612                         return (NULL);
2613         }
2614
2615         return (NULL);
2616 }
2617
2618 /*
2619  * bridge_rtnode_insert:
2620  *
2621  *      Insert the specified bridge node into the route table.  We
2622  *      assume the entry is not already in the table.
2623  */
2624 static int
2625 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
2626 {
2627         struct bridge_rtnode *lbrt;
2628         uint32_t hash;
2629         int dir;
2630
2631         BRIDGE_LOCK_ASSERT(sc);
2632
2633         hash = bridge_rthash(sc, brt->brt_addr);
2634
2635         lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
2636         if (lbrt == NULL) {
2637                 LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
2638                 goto out;
2639         }
2640
2641         do {
2642                 dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
2643                 if (dir == 0)
2644                         return (EEXIST);
2645                 if (dir > 0) {
2646                         LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
2647                         goto out;
2648                 }
2649                 if (LIST_NEXT(lbrt, brt_hash) == NULL) {
2650                         LIST_INSERT_AFTER(lbrt, brt, brt_hash);
2651                         goto out;
2652                 }
2653                 lbrt = LIST_NEXT(lbrt, brt_hash);
2654         } while (lbrt != NULL);
2655
2656 #ifdef DIAGNOSTIC
2657         panic("bridge_rtnode_insert: impossible");
2658 #endif
2659
2660 out:
2661         LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
2662         sc->sc_brtcnt++;
2663
2664         return (0);
2665 }
2666
2667 /*
2668  * bridge_rtnode_destroy:
2669  *
2670  *      Destroy a bridge rtnode.
2671  */
2672 static void
2673 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
2674 {
2675         BRIDGE_LOCK_ASSERT(sc);
2676
2677         LIST_REMOVE(brt, brt_hash);
2678
2679         LIST_REMOVE(brt, brt_list);
2680         sc->sc_brtcnt--;
2681         uma_zfree(bridge_rtnode_zone, brt);
2682 }
2683
2684 /*
2685  * bridge_rtable_expire:
2686  *
2687  *      Set the expiry time for all routes on an interface.
2688  */
2689 static void
2690 bridge_rtable_expire(struct ifnet *ifp, int age)
2691 {
2692         struct bridge_softc *sc = ifp->if_bridge;
2693         struct bridge_rtnode *brt;
2694
2695         BRIDGE_LOCK(sc);
2696
2697         /*
2698          * If the age is zero then flush, otherwise set all the expiry times to
2699          * age for the interface
2700          */
2701         if (age == 0)
2702                 bridge_rtdelete(sc, ifp, IFBF_FLUSHDYN);
2703         else {
2704                 LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
2705                         /* Cap the expiry time to 'age' */
2706                         if (brt->brt_ifp == ifp &&
2707                             brt->brt_expire > time_uptime + age &&
2708                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2709                                 brt->brt_expire = time_uptime + age;
2710                 }
2711         }
2712         BRIDGE_UNLOCK(sc);
2713 }
2714
2715 /*
2716  * bridge_state_change:
2717  *
2718  *      Callback from the bridgestp code when a port changes states.
2719  */
2720 static void
2721 bridge_state_change(struct ifnet *ifp, int state)
2722 {
2723         struct bridge_softc *sc = ifp->if_bridge;
2724         static const char *stpstates[] = {
2725                 "disabled",
2726                 "listening",
2727                 "learning",
2728                 "forwarding",
2729                 "blocking",
2730                 "discarding"
2731         };
2732
2733         if (log_stp)
2734                 log(LOG_NOTICE, "%s: state changed to %s on %s\n",
2735                     sc->sc_ifp->if_xname, stpstates[state], ifp->if_xname);
2736 }
2737
2738 /*
2739  * Send bridge packets through pfil if they are one of the types pfil can deal
2740  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
2741  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
2742  * that interface.
2743  */
2744 static int
2745 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
2746 {
2747         int snap, error, i, hlen;
2748         struct ether_header *eh1, eh2;
2749         struct ip_fw_args args;
2750         struct ip *ip;
2751         struct llc llc1;
2752         u_int16_t ether_type;
2753
2754         snap = 0;
2755         error = -1;     /* Default error if not error == 0 */
2756
2757 #if 0
2758         /* we may return with the IP fields swapped, ensure its not shared */
2759         KASSERT(M_WRITABLE(*mp), ("%s: modifying a shared mbuf", __func__));
2760 #endif
2761
2762         if (pfil_bridge == 0 && pfil_member == 0 && pfil_ipfw == 0)
2763                 return (0); /* filtering is disabled */
2764
2765         i = min((*mp)->m_pkthdr.len, max_protohdr);
2766         if ((*mp)->m_len < i) {
2767             *mp = m_pullup(*mp, i);
2768             if (*mp == NULL) {
2769                 printf("%s: m_pullup failed\n", __func__);
2770                 return (-1);
2771             }
2772         }
2773
2774         eh1 = mtod(*mp, struct ether_header *);
2775         ether_type = ntohs(eh1->ether_type);
2776
2777         /*
2778          * Check for SNAP/LLC.
2779          */
2780         if (ether_type < ETHERMTU) {
2781                 struct llc *llc2 = (struct llc *)(eh1 + 1);
2782
2783                 if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
2784                     llc2->llc_dsap == LLC_SNAP_LSAP &&
2785                     llc2->llc_ssap == LLC_SNAP_LSAP &&
2786                     llc2->llc_control == LLC_UI) {
2787                         ether_type = htons(llc2->llc_un.type_snap.ether_type);
2788                         snap = 1;
2789                 }
2790         }
2791
2792         /*
2793          * If we're trying to filter bridge traffic, don't look at anything
2794          * other than IP and ARP traffic.  If the filter doesn't understand
2795          * IPv6, don't allow IPv6 through the bridge either.  This is lame
2796          * since if we really wanted, say, an AppleTalk filter, we are hosed,
2797          * but of course we don't have an AppleTalk filter to begin with.
2798          * (Note that since pfil doesn't understand ARP it will pass *ALL*
2799          * ARP traffic.)
2800          */
2801         switch (ether_type) {
2802                 case ETHERTYPE_ARP:
2803                 case ETHERTYPE_REVARP:
2804                         if (pfil_ipfw_arp == 0)
2805                                 return (0); /* Automatically pass */
2806                         break;
2807
2808                 case ETHERTYPE_IP:
2809 #ifdef INET6
2810                 case ETHERTYPE_IPV6:
2811 #endif /* INET6 */
2812                         break;
2813                 default:
2814                         /*
2815                          * Check to see if the user wants to pass non-ip
2816                          * packets, these will not be checked by pfil(9) and
2817                          * passed unconditionally so the default is to drop.
2818                          */
2819                         if (pfil_onlyip)
2820                                 goto bad;
2821         }
2822
2823         /* Strip off the Ethernet header and keep a copy. */
2824         m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
2825         m_adj(*mp, ETHER_HDR_LEN);
2826
2827         /* Strip off snap header, if present */
2828         if (snap) {
2829                 m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
2830                 m_adj(*mp, sizeof(struct llc));
2831         }
2832
2833         /*
2834          * Check the IP header for alignment and errors
2835          */
2836         if (dir == PFIL_IN) {
2837                 switch (ether_type) {
2838                         case ETHERTYPE_IP:
2839                                 error = bridge_ip_checkbasic(mp);
2840                                 break;
2841 #ifdef INET6
2842                         case ETHERTYPE_IPV6:
2843                                 error = bridge_ip6_checkbasic(mp);
2844                                 break;
2845 #endif /* INET6 */
2846                         default:
2847                                 error = 0;
2848                 }
2849                 if (error)
2850                         goto bad;
2851         }
2852
2853         if (IPFW_LOADED && pfil_ipfw != 0 && dir == PFIL_OUT && ifp != NULL) {
2854                 error = -1;
2855                 args.rule = ip_dn_claim_rule(*mp);
2856                 if (args.rule != NULL && fw_one_pass)
2857                         goto ipfwpass; /* packet already partially processed */
2858
2859                 args.m = *mp;
2860                 args.oif = ifp;
2861                 args.next_hop = NULL;
2862                 args.eh = &eh2;
2863                 args.inp = NULL;        /* used by ipfw uid/gid/jail rules */
2864                 i = ip_fw_chk_ptr(&args);
2865                 *mp = args.m;
2866
2867                 if (*mp == NULL)
2868                         return (error);
2869
2870                 if (DUMMYNET_LOADED && (i == IP_FW_DUMMYNET)) {
2871
2872                         /* put the Ethernet header back on */
2873                         M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
2874                         if (*mp == NULL)
2875                                 return (error);
2876                         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
2877
2878                         /*
2879                          * Pass the pkt to dummynet, which consumes it. The
2880                          * packet will return to us via bridge_dummynet().
2881                          */
2882                         args.oif = ifp;
2883                         ip_dn_io_ptr(*mp, DN_TO_IFB_FWD, &args);
2884                         return (error);
2885                 }
2886
2887                 if (i != IP_FW_PASS) /* drop */
2888                         goto bad;
2889         }
2890
2891 ipfwpass:
2892         error = 0;
2893
2894         /*
2895          * Run the packet through pfil
2896          */
2897         switch (ether_type) {
2898         case ETHERTYPE_IP:
2899                 /*
2900                  * before calling the firewall, swap fields the same as
2901                  * IP does. here we assume the header is contiguous
2902                  */
2903                 ip = mtod(*mp, struct ip *);
2904
2905                 ip->ip_len = ntohs(ip->ip_len);
2906                 ip->ip_off = ntohs(ip->ip_off);
2907
2908                 /*
2909                  * Run pfil on the member interface and the bridge, both can
2910                  * be skipped by clearing pfil_member or pfil_bridge.
2911                  *
2912                  * Keep the order:
2913                  *   in_if -> bridge_if -> out_if
2914                  */
2915                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2916                         error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
2917                                         dir, NULL);
2918
2919                 if (*mp == NULL || error != 0) /* filter may consume */
2920                         break;
2921
2922                 if (pfil_member && ifp != NULL)
2923                         error = pfil_run_hooks(&inet_pfil_hook, mp, ifp,
2924                                         dir, NULL);
2925
2926                 if (*mp == NULL || error != 0) /* filter may consume */
2927                         break;
2928
2929                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2930                         error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
2931                                         dir, NULL);
2932
2933                 if (*mp == NULL || error != 0) /* filter may consume */
2934                         break;
2935
2936                 /* check if we need to fragment the packet */
2937                 if (pfil_member && ifp != NULL && dir == PFIL_OUT) {
2938                         i = (*mp)->m_pkthdr.len;
2939                         if (i > ifp->if_mtu) {
2940                                 error = bridge_fragment(ifp, *mp, &eh2, snap,
2941                                             &llc1);
2942                                 return (error);
2943                         }
2944                 }
2945
2946                 /* Recalculate the ip checksum and restore byte ordering */
2947                 ip = mtod(*mp, struct ip *);
2948                 hlen = ip->ip_hl << 2;
2949                 if (hlen < sizeof(struct ip))
2950                         goto bad;
2951                 if (hlen > (*mp)->m_len) {
2952                         if ((*mp = m_pullup(*mp, hlen)) == 0)
2953                                 goto bad;
2954                         ip = mtod(*mp, struct ip *);
2955                         if (ip == NULL)
2956                                 goto bad;
2957                 }
2958                 ip->ip_len = htons(ip->ip_len);
2959                 ip->ip_off = htons(ip->ip_off);
2960                 ip->ip_sum = 0;
2961                 if (hlen == sizeof(struct ip))
2962                         ip->ip_sum = in_cksum_hdr(ip);
2963                 else
2964                         ip->ip_sum = in_cksum(*mp, hlen);
2965
2966                 break;
2967 #ifdef INET6
2968         case ETHERTYPE_IPV6:
2969                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2970                         error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2971                                         dir, NULL);
2972
2973                 if (*mp == NULL || error != 0) /* filter may consume */
2974                         break;
2975
2976                 if (pfil_member && ifp != NULL)
2977                         error = pfil_run_hooks(&inet6_pfil_hook, mp, ifp,
2978                                         dir, NULL);
2979
2980                 if (*mp == NULL || error != 0) /* filter may consume */
2981                         break;
2982
2983                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2984                         error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2985                                         dir, NULL);
2986                 break;
2987 #endif
2988         default:
2989                 error = 0;
2990                 break;
2991         }
2992
2993         if (*mp == NULL)
2994                 return (error);
2995         if (error != 0)
2996                 goto bad;
2997
2998         error = -1;
2999
3000         /*
3001          * Finally, put everything back the way it was and return
3002          */
3003         if (snap) {
3004                 M_PREPEND(*mp, sizeof(struct llc), M_DONTWAIT);
3005                 if (*mp == NULL)
3006                         return (error);
3007                 bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
3008         }
3009
3010         M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
3011         if (*mp == NULL)
3012                 return (error);
3013         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
3014
3015         return (0);
3016
3017 bad:
3018         m_freem(*mp);
3019         *mp = NULL;
3020         return (error);
3021 }
3022
3023 /*
3024  * Perform basic checks on header size since
3025  * pfil assumes ip_input has already processed
3026  * it for it.  Cut-and-pasted from ip_input.c.
3027  * Given how simple the IPv6 version is,
3028  * does the IPv4 version really need to be
3029  * this complicated?
3030  *
3031  * XXX Should we update ipstat here, or not?
3032  * XXX Right now we update ipstat but not
3033  * XXX csum_counter.
3034  */
3035 static int
3036 bridge_ip_checkbasic(struct mbuf **mp)
3037 {
3038         struct mbuf *m = *mp;
3039         struct ip *ip;
3040         int len, hlen;
3041         u_short sum;
3042
3043         if (*mp == NULL)
3044                 return (-1);
3045
3046         if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
3047                 if ((m = m_copyup(m, sizeof(struct ip),
3048                         (max_linkhdr + 3) & ~3)) == NULL) {
3049                         /* XXXJRT new stat, please */
3050                         ipstat.ips_toosmall++;
3051                         goto bad;
3052                 }
3053         } else if (__predict_false(m->m_len < sizeof (struct ip))) {
3054                 if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
3055                         ipstat.ips_toosmall++;
3056                         goto bad;
3057                 }
3058         }
3059         ip = mtod(m, struct ip *);
3060         if (ip == NULL) goto bad;
3061
3062         if (ip->ip_v != IPVERSION) {
3063                 ipstat.ips_badvers++;
3064                 goto bad;
3065         }
3066         hlen = ip->ip_hl << 2;
3067         if (hlen < sizeof(struct ip)) { /* minimum header length */
3068                 ipstat.ips_badhlen++;
3069                 goto bad;
3070         }
3071         if (hlen > m->m_len) {
3072                 if ((m = m_pullup(m, hlen)) == 0) {
3073                         ipstat.ips_badhlen++;
3074                         goto bad;
3075                 }
3076                 ip = mtod(m, struct ip *);
3077                 if (ip == NULL) goto bad;
3078         }
3079
3080         if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
3081                 sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
3082         } else {
3083                 if (hlen == sizeof(struct ip)) {
3084                         sum = in_cksum_hdr(ip);
3085                 } else {
3086                         sum = in_cksum(m, hlen);
3087                 }
3088         }
3089         if (sum) {
3090                 ipstat.ips_badsum++;
3091                 goto bad;
3092         }
3093
3094         /* Retrieve the packet length. */
3095         len = ntohs(ip->ip_len);
3096
3097         /*
3098          * Check for additional length bogosity
3099          */
3100         if (len < hlen) {
3101                 ipstat.ips_badlen++;
3102                 goto bad;
3103         }
3104
3105         /*
3106          * Check that the amount of data in the buffers
3107          * is as at least much as the IP header would have us expect.
3108          * Drop packet if shorter than we expect.
3109          */
3110         if (m->m_pkthdr.len < len) {
3111                 ipstat.ips_tooshort++;
3112                 goto bad;
3113         }
3114
3115         /* Checks out, proceed */
3116         *mp = m;
3117         return (0);
3118
3119 bad:
3120         *mp = m;
3121         return (-1);
3122 }
3123
3124 #ifdef INET6
3125 /*
3126  * Same as above, but for IPv6.
3127  * Cut-and-pasted from ip6_input.c.
3128  * XXX Should we update ip6stat, or not?
3129  */
3130 static int
3131 bridge_ip6_checkbasic(struct mbuf **mp)
3132 {
3133         struct mbuf *m = *mp;
3134         struct ip6_hdr *ip6;
3135
3136         /*
3137          * If the IPv6 header is not aligned, slurp it up into a new
3138          * mbuf with space for link headers, in the event we forward
3139          * it.  Otherwise, if it is aligned, make sure the entire base
3140          * IPv6 header is in the first mbuf of the chain.
3141          */
3142         if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
3143                 struct ifnet *inifp = m->m_pkthdr.rcvif;
3144                 if ((m = m_copyup(m, sizeof(struct ip6_hdr),
3145                             (max_linkhdr + 3) & ~3)) == NULL) {
3146                         /* XXXJRT new stat, please */
3147                         ip6stat.ip6s_toosmall++;
3148                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
3149                         goto bad;
3150                 }
3151         } else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
3152                 struct ifnet *inifp = m->m_pkthdr.rcvif;
3153                 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
3154                         ip6stat.ip6s_toosmall++;
3155                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
3156                         goto bad;
3157                 }
3158         }
3159
3160         ip6 = mtod(m, struct ip6_hdr *);
3161
3162         if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
3163                 ip6stat.ip6s_badvers++;
3164                 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
3165                 goto bad;
3166         }
3167
3168         /* Checks out, proceed */
3169         *mp = m;
3170         return (0);
3171
3172 bad:
3173         *mp = m;
3174         return (-1);
3175 }
3176 #endif /* INET6 */
3177
3178 /*
3179  * bridge_fragment:
3180  *
3181  *      Return a fragmented mbuf chain.
3182  */
3183 static int
3184 bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
3185     int snap, struct llc *llc)
3186 {
3187         struct mbuf *m0;
3188         struct ip *ip;
3189         int error = -1;
3190
3191         if (m->m_len < sizeof(struct ip) &&
3192             (m = m_pullup(m, sizeof(struct ip))) == NULL)
3193                 goto out;
3194         ip = mtod(m, struct ip *);
3195
3196         error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist,
3197                     CSUM_DELAY_IP);
3198         if (error)
3199                 goto out;
3200
3201         /* walk the chain and re-add the Ethernet header */
3202         for (m0 = m; m0; m0 = m0->m_nextpkt) {
3203                 if (error == 0) {
3204                         if (snap) {
3205                                 M_PREPEND(m0, sizeof(struct llc), M_DONTWAIT);
3206                                 if (m0 == NULL) {
3207                                         error = ENOBUFS;
3208                                         continue;
3209                                 }
3210                                 bcopy(llc, mtod(m0, caddr_t),
3211                                     sizeof(struct llc));
3212                         }
3213                         M_PREPEND(m0, ETHER_HDR_LEN, M_DONTWAIT);
3214                         if (m0 == NULL) {
3215                                 error = ENOBUFS;
3216                                 continue;
3217                         }
3218                         bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
3219                 } else
3220                         m_freem(m);
3221         }
3222
3223         if (error == 0)
3224                 ipstat.ips_fragmented++;
3225
3226         return (error);
3227
3228 out:
3229         if (m != NULL)
3230                 m_freem(m);
3231         return (error);
3232 }